A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade python3-rgw-debuginfoUpgrade rbd-mirrorUpgrade libcephfs2-debuginfoUpgrade ceph-mdsUpgrade librgw2-debuginfoUpgrade ceph-commonUpgrade rbd-nbdUpgrade rbd-fuse-debuginfoUpgrade python3-radosUpgrade ceph-baseUpgrade python3-rbdUpgrade ceph-grafana-dashboardsUpgrade python3-rados-debuginfoUpgrade python3-ceph-argparseUpgrade libradosstriper1-debuginfoUpgrade python-ceph-argparseUpgrade ceph-debugsourceUpgrade libcephfs2Upgrade python3-cephfsUpgrade ceph-mon-debuginfoUpgrade python-cephfsUpgrade librados-develUpgrade libradospp-develUpgrade libtcmuUpgrade librgw-develUpgrade python3-rgwUpgrade rbd-nbd-debuginfoUpgrade ceph-fuse-debuginfoUpgrade ceph-osd-debuginfoUpgrade librgw2Upgrade ceph-debuginfoUpgrade libcephfs-develUpgrade tcmu-runnerUpgrade ceph-base-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-selinuxUpgrade ceph-radosgwUpgrade python3-cephfs-debuginfoUpgrade libradosstriper1Upgrade ceph-test-debuginfoUpgrade python-rgwUpgrade ceph-mgr-debuginfoUpgrade ceph-common-debuginfoUpgrade python3-rbd-debuginfoUpgrade librbd-develUpgrade ceph-fuseUpgrade ceph-ansibleUpgrade ceph-iscsiUpgrade rbd-mirror-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade ceph-radosgw-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-debugsourceUpgrade libcephfs2-debuginfoUpgrade rbd-nbd-debuginfoUpgrade python3-cephfsUpgrade librgw2Upgrade tcmu-runnerUpgrade ceph-mon-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-baseUpgrade ceph-grafana-dashboardsUpgrade libradospp-develUpgrade python3-radosUpgrade ceph-osd-debuginfoUpgrade ceph-ansibleUpgrade libcephfs2Upgrade libradosstriper1Upgrade python3-ceph-argparseUpgrade librgw2-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-mdsUpgrade python3-rados-debuginfoUpgrade python3-rbdUpgrade librgw-develUpgrade python3-rgwUpgrade ceph-debuginfoUpgrade librados-devel-debuginfoUpgrade libradosstriper1-debuginfoUpgrade librbd-develUpgrade ceph-iscsiUpgrade librados-develUpgrade ceph-base-debuginfoUpgrade python-cephfsUpgrade rbd-nbdUpgrade ceph-fuse-debuginfoUpgrade ceph-radosgwUpgrade libcephfs-develUpgrade rbd-mirror-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-commonUpgrade ceph-selinuxUpgrade python3-rbd-debuginfoUpgrade ceph-mgr-debuginfoUpgrade libtcmuUpgrade python-ceph-argparseUpgrade ceph-fuseUpgrade rbd-mirrorUpgrade python-rgwUpgrade ceph-common-debuginfoUpgrade python3-rgw-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade librados2Upgrade librbd-develUpgrade rbd-fuseUpgrade ceph-testUpgrade rbd-nbdUpgrade rados-objclass-develUpgrade python3-cephfsUpgrade ceph-mgr-cephadmUpgrade rbd-mirrorUpgrade cephUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-dashboardUpgrade ceph-fuseUpgrade python3-rbdUpgrade python3-rgwUpgrade ceph-mgr-rookUpgrade ceph-osdUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mdsUpgrade ceph-prometheus-alertsUpgrade librgw2Upgrade ceph-immutable-object-cacheUpgrade cephadmUpgrade ceph-baseUpgrade ceph-mgr-k8seventsUpgrade libradospp-develUpgrade libcephfs2Upgrade ceph-radosgwUpgrade libcephfs-develUpgrade ceph-grafana-dashboardsUpgrade librgw-develUpgrade librbd1Upgrade python3-ceph-argparseUpgrade librados-develUpgrade ceph-mgr-modules-coreUpgrade ceph-commonUpgrade cephfs-shellUpgrade python3-radosUpgrade ceph-mgrUpgrade ceph-monUpgrade python3-ceph-common | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade radosgwUpgrade ceph-mgr-modules-coreUpgrade ceph-commonUpgrade ceph-mgr-cephadmUpgrade cephadmUpgrade cephUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-baseUpgrade ceph-mgrUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-diskprediction-local | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub