CVE-2020-1699

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-22

Affected software

VendorProductVersions
The Ceph ProjectcephFixed in 14.2.7; Fixed in 15.1.0

References

Timeline

Published
Apr 21, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-169906.2Azure Sphere Information Disclosure VulnerabilityCVE-2020-169917.3Azure Sphere Unsigned Code Execution VulnerabilityCVE-2020-169927.5Azure Sphere Elevation of Privilege VulnerabilityCVE-2020-169935.4Azure Sphere Elevation of Privilege VulnerabilityCVE-2020-169947.3Azure Sphere Unsigned Code Execution VulnerabilityCVE-2020-169957.8<p>An elevation of privilege vulnerability exists in Network Watcher Agent virtual machine extension for Linux. An attacker who successfullyCVE-2020-169966.5Kerberos Security Feature Bypass VulnerabilityCVE-2020-169977.7Remote Desktop Protocol Server Information Disclosure VulnerabilityCVE-2020-169987.0DirectX Elevation of Privilege VulnerabilityCVE-2020-169995.5Windows WalletService Information Disclosure VulnerabilityCVE-2020-17006.5A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by maCVE-2020-170005.5Remote Desktop Protocol Client Information Disclosure Vulnerability
CVE-2020-1699: High severity, CVSS 7.5 | Vulnix