How severe is CVE-2017-12155?

CVE-2017-12155 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2017-12155 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-12155?

CVE-2017-12155 affects Ceph. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-12155?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-12155 published?

CVE-2017-12155 was published on 2017-12-12 and last updated on 2026-06-17.

CVE-2017-12155

CVE-2017-12155 is a medium-severity vulnerability in Ceph with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
CVSS v2: 3.3
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-306
Affected product: Ceph
Published: 2017-12-12
Last modified: 2026-06-17

Description

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

Frequently asked questions

What is CVE-2017-12155?: A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
How severe is CVE-2017-12155?: CVE-2017-12155 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2017-12155 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-12155?: CVE-2017-12155 affects Ceph. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-12155?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-12155 published?: CVE-2017-12155 was published on 2017-12-12 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ceph:ceph:-:*:*:*:*:openstack:*:*

More vulnerabilities in Ceph

CVE-2018-10861 — High (CVSS 8.1): A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can…
CVE-2019-10222 — High (CVSS 7.5): A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated…
CVE-2020-1700 — Medium (CVSS 6.5): A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can…
CVE-2018-1129 — Medium (CVSS 6.5): A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having…
CVE-2017-7519 — Low (CVSS 2.3): In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an…

All CVEs affecting Ceph →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →