cnvd - cnvd-2021-28743

cnvd-2021-28743

Vulnerability from cnvd

Title: Red Hat Ceph Storage路径遍历漏洞

Description:

Red Hat Ceph Storage是美国红帽（Red Hat）公司的一套可扩展的、开放性的软件定义存储平台。

Red Hat Ceph Storage v14.2.5版本、v14.2.6版本和v15.0.0版本中的Ceph仪表板存在路径遍历漏洞。攻击者可利用该漏洞获取信息。

Severity: 中

Patch Name: Red Hat Ceph Storage路径遍历漏洞的补丁

Patch Description:

Red Hat Ceph Storage是美国红帽（Red Hat）公司的一套可扩展的、开放性的软件定义存储平台。

Red Hat Ceph Storage v14.2.5版本、v14.2.6版本和v15.0.0版本中的Ceph仪表板存在路径遍历漏洞。攻击者可利用该漏洞获取信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://ceph.io/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-1699

Impacted products

Name
['Red Hat Ceph Storage 14.2.5', 'Red Hat Ceph Storage 14.2.6', 'Red Hat Ceph Storage 15.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-1699"
    }
  },
  "description": "Red Hat Ceph Storage\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u53ef\u6269\u5c55\u7684\u3001\u5f00\u653e\u6027\u7684\u8f6f\u4ef6\u5b9a\u4e49\u5b58\u50a8\u5e73\u53f0\u3002\n\nRed Hat Ceph Storage v14.2.5\u7248\u672c\u3001v14.2.6\u7248\u672c\u548cv15.0.0\u7248\u672c\u4e2d\u7684Ceph\u4eea\u8868\u677f\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://ceph.io/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-28743",
  "openTime": "2021-04-16",
  "patchDescription": "Red Hat Ceph Storage\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u53ef\u6269\u5c55\u7684\u3001\u5f00\u653e\u6027\u7684\u8f6f\u4ef6\u5b9a\u4e49\u5b58\u50a8\u5e73\u53f0\u3002\r\n\r\nRed Hat Ceph Storage v14.2.5\u7248\u672c\u3001v14.2.6\u7248\u672c\u548cv15.0.0\u7248\u672c\u4e2d\u7684Ceph\u4eea\u8868\u677f\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Red Hat Ceph Storage\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Red Hat Ceph Storage 14.2.5",
      "Red Hat Ceph Storage 14.2.6",
      "Red Hat Ceph Storage 15.0.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-1699",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-22",
  "title": "Red Hat Ceph Storage\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

CVE-2020-1699 (GCVE-0-2020-1699)

Vulnerability from cvelistv5

Published

2020-04-21 15:27

Modified

2024-08-04 06:46

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200

Summary

A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	The Ceph Project	ceph	Version: Fixed in 14.2.7 Version: Fixed in 15.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:30.457Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ceph",
          "vendor": "The Ceph Project",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 14.2.7"
            },
            {
              "status": "affected",
              "version": "Fixed in 15.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-21T15:27:07",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-1699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ceph",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in 14.2.7"
                          },
                          {
                            "version_value": "Fixed in 15.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The Ceph Project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-1699",
    "datePublished": "2020-04-21T15:27:07",
    "dateReserved": "2019-11-27T00:00:00",
    "dateUpdated": "2024-08-04T06:46:30.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted