CVE-2016-7031

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-10-03 · updated 2026-06-17
Weakness: CWE-200

Description

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.

Affected products

Ceph Project Ceph: through 10.0.0
Red Hat Ceph Storage: through 1.3.2

References

http://docs.ceph.com/docs/master/release-notes/#v10-0-1
http://rhn.redhat.com/errata/RHSA-2016-1972.html
http://rhn.redhat.com/errata/RHSA-2016-1973.html
http://tracker.ceph.com/issues/13207
http://www.securityfocus.com/bid/93240
https://github.com/ceph/ceph/pull/6057
http://docs.ceph.com/docs/master/release-notes/#v10-0-1
http://rhn.redhat.com/errata/RHSA-2016-1972.html
http://rhn.redhat.com/errata/RHSA-2016-1973.html
http://tracker.ceph.com/issues/13207
http://www.securityfocus.com/bid/93240
https://github.com/ceph/ceph/pull/6057

Get alerted when CVE-2016-7031 or the next vulnerability affects your stack