CVE-2020-1716

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-171628.8Microsoft Windows Security Feature Bypass VulnerabilityCVE-2020-171637.8Visual Studio Code Python Extension Remote Code Execution VulnerabilityCVE-2020-17172.7A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.CVE-2020-17188.8A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized accesCVE-2020-17195.4A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The hCVE-2020-17206.5A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticatedCVE-2020-17216.1A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID duCVE-2020-17225.3A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the pasCVE-2020-17236.1A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. AffCVE-2020-17244.3A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal inCVE-2020-17255.4A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappingsCVE-2020-17265.9A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are
CVE-2020-1716: High severity, CVSS 8.8 | Vulnix