CVE-2020-1716 Hardcoded credentials in ceph-ansible
Hardcoded default passwords in ceph-ansible allow authenticated attackers to gain administrator access and modify Ceph cluster configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1716?
CVE-2020-1716 is a high-severity vulnerability in ceph-ansible, published on 28 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Weakness: CWE-798
Which versions are affected by CVE-2020-1716?
It affects 1 product.
Linux distribution packages (3)
ceph-ansible Red Hat:ceph_storage:4::el7 | All versions | 0:4.0.23-1.el7cp |
ceph-ansible Red Hat:ceph_storage:4::el8 | All versions | 0:4.0.23-1.el8cp |
smartmontools Rocky Linux:8 | All versions | 1:7.1-1.el8 |
Products include Ceph Ceph-Ansible.
How do I fix CVE-2020-1716?
Upgrade to a fixed version.
Is CVE-2020-1716 being exploited?
There is no known exploitation of CVE-2020-1716 in the wild and no public exploit code.
Other vulnerabilities in ceph-ansible
Sources
Also known as GHSA-v27v-7hmw-76p2, RHSA-2020:2231, RLSA-2020:2231.