CVE-2020-1716: ceph ceph-ansible Use of Hard-coded Credentials
Vulnerability summary
CVE-2020-1716 is a high (CVSS 9.0) Use of Hard-coded Credentials vulnerability in ceph ceph-ansible. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.8% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 28-05-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ceph1 product
- ceph-ansible≤ 5.0.3
Redhat1 product
- ceph-ansible< 0:4.0.23-1.el7cp | < 0:4.0.23-1.el8cp
2 vendors · 2 products
References
168 links- bugzilla.redhat.com/show_bug.cgi?id=1795592X Refsource MISCREPORTExploitIssue TrackingVendor Advisory
Show all 100 references
Showing 100 of 168.