A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade libradosstriper1-debuginfoUpgrade python-ceph-argparseUpgrade python3-rgw-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-baseUpgrade ceph-debugsourceUpgrade python3-radosUpgrade python-cephfsUpgrade rbd-mirrorUpgrade libcephfs2-debuginfoUpgrade ceph-debuginfoUpgrade libradospp-develUpgrade librgw2Upgrade librados-develUpgrade libtcmuUpgrade ceph-mon-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-mdsUpgrade librgw2-debuginfoUpgrade ceph-commonUpgrade rbd-nbdUpgrade rbd-fuse-debuginfoUpgrade libcephfs-develUpgrade python3-rbdUpgrade ceph-fuse-debuginfoUpgrade python3-rgwUpgrade librgw-develUpgrade python3-rados-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-osd-debuginfoUpgrade python3-cephfsUpgrade libcephfs2Upgrade tcmu-runnerUpgrade ceph-radosgw-debuginfoUpgrade ceph-ansibleUpgrade librbd-develUpgrade ceph-selinuxUpgrade ceph-radosgwUpgrade ceph-iscsiUpgrade ceph-mgr-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-common-debuginfoUpgrade python3-rbd-debuginfoUpgrade librados-devel-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python-rgwUpgrade libradosstriper1Upgrade ceph-test-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-fuse | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade libtcmuUpgrade ceph-commonUpgrade librbd-develUpgrade ceph-radosgwUpgrade librados-devel-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python-rgwUpgrade ceph-base-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-iscsiUpgrade ceph-common-debuginfoUpgrade python3-rbd-debuginfoUpgrade rbd-mirrorUpgrade ceph-selinuxUpgrade python3-rgw-debuginfoUpgrade rbd-nbdUpgrade python-cephfsUpgrade librados-develUpgrade ceph-fuse-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-debuginfoUpgrade libcephfs-develUpgrade libradosstriper1-debuginfoUpgrade ceph-fuseUpgrade python-ceph-argparseUpgrade python3-cephfs-debuginfoUpgrade tcmu-runnerUpgrade ceph-radosgw-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-osd-debuginfoUpgrade ceph-mdsUpgrade ceph-debugsourceUpgrade libcephfs2-debuginfoUpgrade librgw2Upgrade python3-rgwUpgrade libcephfs2Upgrade librgw-develUpgrade ceph-ansibleUpgrade librgw2-debuginfoUpgrade python3-cephfsUpgrade libradospp-develUpgrade python3-ceph-argparseUpgrade ceph-mon-debuginfoUpgrade libradosstriper1Upgrade rbd-fuse-debuginfoUpgrade ceph-baseUpgrade python3-radosUpgrade python3-rados-debuginfoUpgrade python3-rbd | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-dashboardUpgrade rbd-fuseUpgrade ceph-prometheus-alertsUpgrade ceph-immutable-object-cacheUpgrade librgw2Upgrade python3-cephfsUpgrade cephUpgrade ceph-fuseUpgrade python3-rbdUpgrade rbd-mirrorUpgrade ceph-mdsUpgrade ceph-osdUpgrade python3-rgwUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-testUpgrade ceph-baseUpgrade cephadmUpgrade librados2Upgrade ceph-mgr-k8seventsUpgrade ceph-mgr-rookUpgrade rbd-nbdUpgrade librbd-develUpgrade rados-objclass-develUpgrade libradospp-develUpgrade librbd1Upgrade python3-ceph-commonUpgrade ceph-radosgwUpgrade ceph-mgrUpgrade librgw-develUpgrade ceph-commonUpgrade libcephfs2Upgrade cephfs-shellUpgrade python3-radosUpgrade ceph-monUpgrade ceph-mgr-modules-coreUpgrade librados-develUpgrade python3-ceph-argparseUpgrade ceph-grafana-dashboardsUpgrade libcephfs-devel | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade cephadmUpgrade cephUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgrUpgrade ceph-mgr-k8seventsUpgrade ceph-baseUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-cephadmUpgrade radosgwUpgrade ceph-commonUpgrade ceph-mgr-modules-core | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub