CVE-2016-7031

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.ceph.com/docs/master/release-notes/#v10-0-1Release Notes, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-1972.htmlRelease Notes, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1973.html
http://tracker.ceph.com/issues/13207Exploit, Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/93240
https://github.com/ceph/ceph/pull/6057Patch, Vendor Advisory
http://docs.ceph.com/docs/master/release-notes/#v10-0-1Release Notes, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-1972.htmlRelease Notes, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1973.html
http://tracker.ceph.com/issues/13207Exploit, Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/93240
https://github.com/ceph/ceph/pull/6057Patch, Vendor Advisory

Timeline

Published: Oct 3, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70327.0sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that CVE-2016-70336.1Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attacker CVE-2016-70348.8The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them i CVE-2016-70357.8An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivile CVE-2016-70369.8python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.CVE-2016-70377.5The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, wh CVE-2016-70387.3In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.CVE-2016-70397.5The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibl CVE-2016-70408.8Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and t CVE-2016-70416.5Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory CVE-2016-70426.2The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protecto CVE-2016-70439.8It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java proper