Vulnerability Description
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Ceph | >= 15.2.0, < 15.2.2 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10736Issue TrackingThird Party Advisory
- https://ceph.io/releases/v15-2-2-octopus-released/Release NotesVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10736Issue TrackingThird Party Advisory
- https://ceph.io/releases/v15-2-2-octopus-released/Release NotesVendor Advisory
FAQ
What is CVE-2020-10736?
CVE-2020-10736 is a vulnerability with a CVSS score of 8.0 (HIGH). An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthori...
How severe is CVE-2020-10736?
CVE-2020-10736 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10736?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Ceph.