CVEvulnerability
CVE-2020-25678
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-01-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-312
Description
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
Affected configurations
• redhat ceph (< 16.2.0)
• redhat ceph storage 4.0
• fedoraproject fedora 33
Related
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1892109 Issue Tracking, Patch
- https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202105-39 Third Party Advisory
- https://tracker.ceph.com/issues/37503 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1892109 Issue Tracking, Patch
- https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202105-39 Third Party Advisory
- https://tracker.ceph.com/issues/37503 Patch, Vendor Advisory