A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-mdsUpgrade tcmu-runnerUpgrade libcephfs2Upgrade python3-radosUpgrade python3-ceph-argparseUpgrade ceph-fuse-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-ansibleUpgrade ceph-selinuxUpgrade python3-cephfs-debuginfoUpgrade ceph-osd-debuginfoUpgrade librbd-develUpgrade libradosstriper1-debuginfoUpgrade librgw2Upgrade ceph-radosgw-debuginfoUpgrade python3-rados-debuginfoUpgrade python-ceph-argparseUpgrade libradosstriper1Upgrade python3-rbdUpgrade python3-cephfsUpgrade librgw2-debuginfoUpgrade python-rgwUpgrade ceph-mon-debuginfoUpgrade ceph-debugsourceUpgrade ceph-test-debuginfoUpgrade python3-rgwUpgrade libradospp-develUpgrade ceph-base-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-iscsiUpgrade rbd-mirror-debuginfoUpgrade rbd-nbdUpgrade python3-rbd-debuginfoUpgrade rbd-mirrorUpgrade rbd-nbd-debuginfoUpgrade ceph-mds-debuginfoUpgrade librados-devel-debuginfoUpgrade librgw-develUpgrade libtcmuUpgrade libcephfs2-debuginfoUpgrade ceph-debuginfoUpgrade libcephfs-develUpgrade ceph-commonUpgrade ceph-baseUpgrade python-cephfsUpgrade librados-develUpgrade ceph-fuseUpgrade ceph-radosgwUpgrade ceph-grafana-dashboardsUpgrade python3-rgw-debuginfo | Jun 16, 2021 | May 26, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 26, 2021 |
| Redhat_linux | — | Upgrade ceph-debuginfoUpgrade python3-rbdUpgrade libtcmuUpgrade libcephfs2Upgrade libcephfs-develUpgrade tcmu-runnerUpgrade ceph-grafana-dashboardsUpgrade libradospp-develUpgrade ceph-base-debuginfoUpgrade librgw-develUpgrade libcephfs2-debuginfoUpgrade ceph-fuse-debuginfoUpgrade ceph-baseUpgrade librados-develUpgrade python3-rbd-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-debugsourceUpgrade ceph-mgr-debuginfoUpgrade librados-devel-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-commonUpgrade rbd-fuse-debuginfoUpgrade ceph-selinuxUpgrade ceph-ansibleUpgrade python3-rados-debuginfoUpgrade ceph-mon-debuginfoUpgrade python3-radosUpgrade python3-rgw-debuginfoUpgrade python-ceph-argparseUpgrade librgw2-debuginfoUpgrade ceph-common-debuginfoUpgrade librgw2Upgrade python-rgwUpgrade python3-cephfsUpgrade ceph-mdsUpgrade ceph-radosgw-debuginfoUpgrade ceph-radosgwUpgrade ceph-mds-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-fuseUpgrade libradosstriper1-debuginfoUpgrade rbd-nbdUpgrade rbd-mirrorUpgrade librbd-develUpgrade python-cephfsUpgrade python3-cephfs-debuginfoUpgrade libradosstriper1Upgrade ceph-iscsiUpgrade ceph-osd-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python3-rgw | Jun 16, 2021 | May 26, 2021 |
| Suse | — | Upgrade librados-develUpgrade librados2Upgrade python3-ceph-commonUpgrade ceph-immutable-object-cacheUpgrade ceph-grafana-dashboardsUpgrade ceph-fuseUpgrade rbd-fuseUpgrade cephadmUpgrade librbd-develUpgrade librgw-develUpgrade ceph-mgr-rookUpgrade python3-rgwUpgrade ceph-radosgwUpgrade ceph-mgr-diskprediction-cloudUpgrade librbd1Upgrade ceph-mgr-k8seventsUpgrade rados-objclass-develUpgrade libcephfs2Upgrade ceph-monUpgrade python3-rbdUpgrade cephUpgrade rbd-nbdUpgrade ceph-prometheus-alertsUpgrade python3-cephfsUpgrade librgw2Upgrade libradospp-develUpgrade ceph-mgr-dashboardUpgrade ceph-mgrUpgrade rbd-mirrorUpgrade libcephfs-develUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-modules-coreUpgrade python3-ceph-argparseUpgrade python3-radosUpgrade ceph-mgr-cephadmUpgrade ceph-mdsUpgrade ceph-commonUpgrade cephfs-shellUpgrade ceph-baseUpgrade ceph-osdUpgrade ceph-test | Apr 13, 2021 | Apr 9, 2021 |
| Ubuntu | — | Upgrade cephUpgrade ceph-mgr-dashboardUpgrade radosgwUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-diskprediction-cloudUpgrade cephadmUpgrade ceph-mgr-k8seventsUpgrade ceph-commonUpgrade ceph-mgr-rookUpgrade ceph-baseUpgrade ceph-mgrUpgrade ceph-mgr-modules-core | Jun 25, 2021 | Apr 9, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub