8.0
High
CVE-2020-10736 An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr…
Description
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ceph | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- ceph.io ceph.io
Timeline
- Published
- Last modified
Other CVEs of ceph
The 7 CVEs of ceph →
CVE-2020-1760
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3
5.8
Medium
CVE-2020-1700
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects
6.5
Medium
CVE-2019-3821
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled
7.5
High
CVE-2018-14662
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt…
3.5
Low