CVE-2020-1716: 
Rocky Linux vulnerability analysis and mitigation

A flaw was found in the ceph-ansible playbook (CVE-2020-1716) where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. The vulnerability affects versions before ceph-ansible 6.0.0alpha1 (NVD).

The vulnerability is classified as Use of Hard-coded Credentials (CWE-798) with a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue stems from hardcoded passwords found in roles/ceph-defaults/defaults/main.yml configuration file (Bugzilla).

Any authenticated attacker can abuse this flaw to brute-force Ceph deployments and gain administrator access to Ceph clusters via the Ceph dashboard. Once access is gained, attackers can initiate read, write, and delete operations on Ceph clusters as well as modify Ceph cluster configurations (NVD).

The vulnerability requires network access and low privilege level for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit for authenticated attackers (NVD).

Users should change and use strong passwords in the ceph-ansible playbook, particularly in the roles/ceph-defaults/defaults/main.yml file. The vulnerability has been fixed in ceph-ansible version 6.0.0alpha1 and later. Red Hat has addressed this issue in Red Hat Ceph Storage 4.1 through RHSA-2020:2231 (Bugzilla).