CVE-2020-1716
Last modified
CVE-2020-1716 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. EPSS estimates a 1.27% chance of exploitation in the next 30 days.
Description
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ceph | Ceph-Ansible | <= 5.0.3 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1795592Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1795592Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1716?
How severe is CVE-2020-1716?
How do I fix CVE-2020-1716?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-17150Visual Studio Code Remote Code Execution Vulnerability7.8
- CVE-2020-17152Microsoft Dynamics 365 for Finance and Operations (on-premis…8.8
- CVE-2020-17153Microsoft Edge for Android Spoofing Vulnerability4.3
- CVE-2020-17156Visual Studio Remote Code Execution Vulnerability7.8
- CVE-2020-17158Microsoft Dynamics 365 for Finance and Operations (on-premis…8.8
- CVE-2020-17159Visual Studio Code Java Extension Pack Remote Code Execution…7.8
- CVE-2020-17160Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-17162Microsoft Windows Security Feature Bypass Vulnerability8.8
- CVE-2020-17163Visual Studio Code Python Extension Remote Code Execution Vu…7.8
- CVE-2020-1717A flaw was found in Keycloak 7.0.1. A logged in user can do …2.7
- CVE-2020-1718A flaw was found in the reset credential flow in all Keycloa…8.8
- CVE-2020-1719A flaw was found in wildfly. The EJBContext principle is not…5.4
Are you affected by CVE-2020-1716?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST