CVE-2020-10736: High severity linuxfoundation Ceph vulnerability
Published Jun 22, 2020
·Updated
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
Affected Software
2 affected componentsFixes available
debian/ceph
14.2.21-116.2.11+ds-218.2.4+ds-7
linuxfoundation Ceph>=15.2.0<15.2.2
Remediation
Event History
Jun 22, 2020
CVE Published
via MITRE·05:49 PM
Data Sourced
via MITRE·05:49 PM
DescriptionSeverityWeakness
Jan 11, 2024
Data Sourced
via Launchpad·11:35 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:20 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2020-10736?
CVE-2020-10736 is an authorization bypass vulnerability found in Ceph versions 15.2.0 before 15.2.2.
2
Which components are affected by CVE-2020-10736?
The ceph-mon and ceph-mgr daemons are affected by CVE-2020-10736.
3
How can an attacker exploit CVE-2020-10736?
An authenticated client can exploit CVE-2020-10736 to gain access to unauthorized resources and modify the configuration.
4
What is the severity of CVE-2020-10736?
CVE-2020-10736 has a severity value of 8, considered high.
5
How can I fix CVE-2020-10736?
Upgrading Ceph to version 15.2.2 or later will fix CVE-2020-10736.