PT-2020-12301 · Red Hat+2 · Ceph+2

Josh Durgin + 1 · Published 2020-06-22 · Updated 2026-03-20 · CVE-2020-10736

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ceph versions 15.2.0 through 15.2.1

Description An authorization bypass issue was found in the ceph-mon and ceph-mgr daemons, where they do not properly restrict access. This allows an authenticated client to gain access to unauthorized resources, modify the configuration, and possibly conduct further attacks.

Recommendations For versions 15.2.0 through 15.2.1, update to version 15.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ceph-mon and ceph-mgr daemons to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-CEPH-2020-10736

CVE-2020-10736

OPENSUSE-SU-2024:10676-1

USN-4706-1

Affected Products

Ceph

Linuxmint

Ubuntu

References · 14

• https://ceph.io/releases/v15-2-2-octopus-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10736 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10736 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10736 · Security Note
• https://osv.dev/vulnerability/BIT-ceph-2020-10736 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10736 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4706-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4706-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25660 · Vendor Advisory
• https://t.me/cibsecurity/13018 · Telegram Post
• https://t.me/cvenotify/4575 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10736 · Note