CVE-2020-25678

Published: Jan 8, 2021Modified: Jun 17, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.

Affected (3)

Products: Redhat: Ceph, Ceph Storage · Fedoraproject: Fedora

2 products

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Ceph	Before 16.2.0
Redhat Ceph Storage	Version 4.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (10)

https://bugzilla.redhat.com/show_bug.cgi?id=1892109

Source: secalert@redhat.com

Issue TrackingPatch

https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202105-39

Source: secalert@redhat.com

Third Party Advisory

https://tracker.ceph.com/issues/37503

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1892109