CVE-2020-25678

CWE-312 — Cleartext Storage of Sensitive Info9 documents8 sources
Severity
4.4MEDIUM
EPSS
0.0%
top 97.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat CephFedoraproject FedoraRedhat Ceph Storage
Timeline
PublishedJan 8
Latest updateMay 24

Description

A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages5 packages

▶NVDredhat/ceph< 16.2.0
▶Debianceph< 14.2.18-1+3
▶Ubuntuceph< 15.2.12-0ubuntu0.20.04.1
▶CVEListV5cephceph versions prior to 16.y.z

Also affects: Fedora 33

Patches

Patch: bugzilla.redhat.com ↗Patch: tracker.ceph.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-h22j-342g-797c: A flaw was found in ceph in versions prior to 16↗2022-05-24
▶
OSV
ceph vulnerabilities↗2021-06-25
▶
CVEList
CVE-2020-25678: A flaw was found in ceph in versions prior to 16↗2021-01-08
▶
OSV
CVE-2020-25678: A flaw was found in ceph in versions prior to 16↗2021-01-08
▶

📋Vendor Advisories

3
Ubuntu
Ceph vulnerabilities↗2021-06-25
▶
Red Hat
ceph: mgr modules' passwords are in clear text in mgr logs↗2020-11-23
▶
Debian
CVE-2020-25678: ceph - A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr modul...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-25678 ceph: mgr modules' passwords are in clear text in mgr logs↗2020-10-27
▶
CVE-2020-25678 (MEDIUM CVSS 4.4) | A flaw was found in ceph in version | cvebase.io