CVE-2025-52555

mediumPriorität · verfolgen · 0EPSS 0.002 · 11. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (11th) EPSS

CVSS 6.5 · medium

Is it mine?

12 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.5mediumAV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.3 · Auswirkung 4.7

v3.16mediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-269USCWE-269US

betroffene Produkte (12)

Betroffene Produkte und Versionsbereiche.

ceph Ceph≤ = 17.2.7enisa_euvdEU
ceph Ceph18.2.1, → 18.2.5enisa_euvdEU
ceph Ceph19.0.0, → 19.2.3enisa_euvdEU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.15fstec_bduRU
АО «СберТех» Platform V SberLinux OS Server≤ 9.1.1-fstecfstec_bduRU
АО «СберТех» Platform V SberLinux OS Server≤ 9.1fstec_bduRU
Сообщество свободного программного обеспечения Ceph≤ 18.2.5fstec_bduRU
Сообщество свободного программного обеспечения Ceph≤ 19.2.3fstec_bduRU
Сообщество свободного программного обеспечения Ceph≤ 17.2.8fstec_bduRU
Bitnami ceph17.2.7 → 17.2.8osvUSpkg:bitnami/ceph
Bitnami ceph18.2.1 → 18.2.5osvUSpkg:bitnami/ceph
Bitnami ceph19.0.0 → 19.2.3osvUSpkg:bitnami/ceph

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

BIT-ceph-2025-52555CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS2026-03-20vendor · osvUS
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

veröffentlicht 2025-06-26geändert 2026-09-22

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan