CVE-2020-1699
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5,...
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
CVE-2020-1699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2020-12555
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
EUVD-2020-12555- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c7h3-g28j-x6jq No score
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5,...
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
GHSA-c7h3-g28j-x6jq- Updated
- 2026-11-02
NVD
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
CVE-2020-1699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-1699
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
ALPINE-CVE-2020-1699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
CVE-2020-1699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2020-1699
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
DEBIAN-CVE-2020-1699- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-ceph-2020-1699 No score
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
- Record
BIT-ceph-2020-1699- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0187-1 No score
Security update for ceph
This update for ceph fixes the following issues:
- CVE-2020-1700: Fixed a denial of service against the RGW server via connection leakage (bsc#1161312).
- CVE-2020-1699: Fixed a information disclosure by improper URL checking (bsc#1161074).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0187-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0296-1 No score
Security update for ceph
This update for ceph fixes the following issues:
- CVE-2020-1700: Fixed a denial of service against the RGW server via connection leakage (bsc#1161312).
- CVE-2020-1699: Fixed a information disclosure by improper URL checking (bsc#1161074).
- Record
SUSE-SU-2020:0296-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAlpine:v3.10 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.11 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.12 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.13 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.14 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.15 |
before 14.2.7-r0 | 14.2.7-r0 |
cephAlpine:v3.16 |
before 14.2.7-r0 | 14.2.7-r0 |
ceph16Alpine:v3.17 |
before 14.2.7-r0 | 14.2.7-r0 |
ceph16Alpine:v3.18 |
before 14.2.7-r0 | 14.2.7-r0 |
cephBitnami |
14.2.5 to 14.2.5, 14.2.6 to 14.2.6, 15.0.0 to 15.0.0 | None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cephDebian:12 |
before 14.2.6-4 | 14.2.6-4 |
cephDebian:13 |
before 14.2.6-4 | 14.2.6-4 |
cephDebian:14 |
before 14.2.6-4 | 14.2.6-4 |
cephSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 2 CVEs |
before 14.2.5.382+g8881d33957-3.30.1 | 14.2.5.382+g8881d33957-3.30.1 |
cephSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 14.2.5.382+g8881d33957-3.30.1 | 14.2.5.382+g8881d33957-3.30.1 |
cephopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 14.2.5.382+g8881d33957-lp151.2.10.1 | 14.2.5.382+g8881d33957-lp151.2.10.1 |
ceph-testopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 14.2.5.382+g8881d33957-lp151.2.10.1 | 14.2.5.382+g8881d33957-lp151.2.10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1699 is a high vulnerability (CVSS 7.5) in Ceph, published January 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in ceph 14.2.7-r0.