CVE-2025-52555: fallo de gravedad media en ceph
CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.2%
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Productos afectados
ceph · cephCVEs relacionadas — ceph
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-47866HIGHRGW DoS attack with empty HTTP header in S3 object copyEPSS 0.5%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-39944HIGHCeph: CephX AES Authentication errorEPSS 0.3%CVE-2026-50152CRITICALCeph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only usersEPSS 0.2%CVE-2024-48916HIGHCeph is vulnerable to authentication bypass through RadosGWEPSS 0.2%CVE-2025-30156HIGHCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgeryEPSS 0.1%