A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade python-cephfsUpgrade ceph-mon-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-osd-debuginfoUpgrade python3-rgw-debuginfoUpgrade python3-rbdUpgrade librados-develUpgrade libcephfs-develUpgrade rbd-fuse-debuginfoUpgrade rbd-nbdUpgrade libtcmuUpgrade librgw-develUpgrade python3-rgwUpgrade ceph-fuse-debuginfoUpgrade librgw2Upgrade libcephfs2Upgrade python3-ceph-argparseUpgrade python3-cephfsUpgrade rbd-nbd-debuginfoUpgrade libradospp-develUpgrade ceph-debugsourceUpgrade ceph-grafana-dashboardsUpgrade ceph-debuginfoUpgrade libcephfs2-debuginfoUpgrade ceph-commonUpgrade ceph-mdsUpgrade ceph-baseUpgrade librgw2-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python-ceph-argparseUpgrade rbd-mirrorUpgrade python3-radosUpgrade ceph-ansibleUpgrade rbd-mirror-debuginfoUpgrade python-rgwUpgrade libradosstriper1Upgrade librbd-develUpgrade ceph-fuseUpgrade ceph-mgr-debuginfoUpgrade ceph-radosgwUpgrade python3-rbd-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-iscsiUpgrade tcmu-runnerUpgrade ceph-selinuxUpgrade ceph-radosgw-debuginfoUpgrade ceph-common-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade ceph-osd-debuginfoUpgrade ceph-mdsUpgrade libradospp-develUpgrade ceph-grafana-dashboardsUpgrade libcephfs2-debuginfoUpgrade python3-rados-debuginfoUpgrade python3-radosUpgrade rbd-fuse-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-mon-debuginfoUpgrade ceph-debugsourceUpgrade ceph-test-debuginfoUpgrade tcmu-runnerUpgrade python3-cephfsUpgrade python3-cephfs-debuginfoUpgrade python3-rbdUpgrade ceph-ansibleUpgrade python3-rgwUpgrade librgw-develUpgrade libcephfs2Upgrade librgw2-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-baseUpgrade librgw2Upgrade libradosstriper1Upgrade ceph-selinuxUpgrade python-rgwUpgrade python3-rgw-debuginfoUpgrade ceph-base-debuginfoUpgrade python3-rbd-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-mgr-debuginfoUpgrade libcephfs-develUpgrade ceph-mds-debuginfoUpgrade ceph-radosgwUpgrade python-cephfsUpgrade ceph-commonUpgrade ceph-fuse-debuginfoUpgrade rbd-nbdUpgrade python-ceph-argparseUpgrade libtcmuUpgrade rbd-mirror-debuginfoUpgrade ceph-debuginfoUpgrade librados-develUpgrade libradosstriper1-debuginfoUpgrade librbd-develUpgrade rbd-mirrorUpgrade ceph-fuseUpgrade ceph-iscsiUpgrade ceph-common-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-monUpgrade ceph-mgrUpgrade ceph-mgr-modules-coreUpgrade python3-ceph-argparseUpgrade librgw-develUpgrade python3-radosUpgrade librados-develUpgrade cephfs-shellUpgrade libcephfs-develUpgrade ceph-radosgwUpgrade ceph-grafana-dashboardsUpgrade ceph-commonUpgrade libcephfs2Upgrade librbd1Upgrade python3-ceph-commonUpgrade python3-cephfsUpgrade ceph-testUpgrade rbd-fuseUpgrade ceph-fuseUpgrade rbd-nbdUpgrade ceph-mgr-cephadmUpgrade cephadmUpgrade cephUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-diskprediction-localUpgrade ceph-prometheus-alertsUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-baseUpgrade ceph-osdUpgrade ceph-mgr-rookUpgrade ceph-mdsUpgrade python3-rgwUpgrade python3-rbdUpgrade rbd-mirrorUpgrade librados2Upgrade ceph-mgr-k8seventsUpgrade rados-objclass-develUpgrade librgw2Upgrade librbd-develUpgrade ceph-immutable-object-cacheUpgrade libradospp-devel | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade ceph-mgr-dashboardUpgrade cephUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-rookUpgrade ceph-mgr-k8seventsUpgrade ceph-mgrUpgrade cephadmUpgrade ceph-baseUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-modules-coreUpgrade ceph-commonUpgrade radosgwUpgrade ceph-mgr-cephadm | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub