CVE-2016-7031: ceph_project ceph
Vulnerability summary
CVE-2016-7031 is a high (CVSS 7.5) vulnerability in ceph_project ceph. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.8% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 03-10-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated3.0LowCVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.75%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.75% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (tracker.ceph.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat18 products
- ceph_storage≤ 1.3.2
- calamari-server< 0:1.3.3-2.el7cp
- ceph< 1:0.94.9-3.el7cp
- ceph-common< 1:0.94.9-3.el7cp
- ceph-debuginfo< 1:0.94.9-3.el7cp
Ceph_project1 product
- ceph≤ 10.0.0
Debian1 product
- ceph< 10.2.5-1
Ubuntu1 product
- ceph< 0.80.11-0ubuntu1.14.04.3
4 vendors · 21 products
References
46 links- rhn.redhat.com/errata/RHSA-2016-1972.htmlVendor AdvisoryX Refsource REDHATRelease NotesThird Party Advisory
