A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade rbd-mirror-debuginfoUpgrade ceph-iscsiUpgrade ceph-test-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-selinuxUpgrade python3-cephfs-debuginfoUpgrade ceph-radosgwUpgrade tcmu-runnerUpgrade ceph-fuseUpgrade librbd-develUpgrade ceph-ansibleUpgrade python3-rbd-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-mds-debuginfoUpgrade libradosstriper1Upgrade python-rgwUpgrade ceph-base-debuginfoUpgrade python3-rbdUpgrade librgw2-debuginfoUpgrade ceph-mdsUpgrade ceph-commonUpgrade ceph-baseUpgrade python3-radosUpgrade ceph-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-mirrorUpgrade python3-rgw-debuginfoUpgrade python-ceph-argparseUpgrade libradosstriper1-debuginfoUpgrade libcephfs2-debuginfoUpgrade python3-rados-debuginfoUpgrade python3-cephfsUpgrade python3-ceph-argparseUpgrade libcephfs2Upgrade rbd-nbdUpgrade rbd-fuse-debuginfoUpgrade python3-rgwUpgrade librgw-develUpgrade libcephfs-develUpgrade ceph-fuse-debuginfoUpgrade ceph-mon-debuginfoUpgrade libradospp-develUpgrade ceph-grafana-dashboardsUpgrade librados-develUpgrade ceph-osd-debuginfoUpgrade libtcmuUpgrade librgw2Upgrade ceph-debugsourceUpgrade python-cephfs | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade ceph-osd-debuginfoUpgrade python3-ceph-argparseUpgrade python3-cephfs-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-test-debuginfoUpgrade ceph-debugsourceUpgrade rbd-nbd-debuginfoUpgrade librgw2Upgrade libcephfs2-debuginfoUpgrade python3-cephfsUpgrade ceph-baseUpgrade python3-rados-debuginfoUpgrade python3-rbdUpgrade python3-radosUpgrade tcmu-runnerUpgrade ceph-mdsUpgrade ceph-mon-debuginfoUpgrade libradosstriper1Upgrade libradospp-develUpgrade ceph-ansibleUpgrade python3-rgwUpgrade ceph-radosgw-debuginfoUpgrade libcephfs2Upgrade rbd-fuse-debuginfoUpgrade librgw-develUpgrade librgw2-debuginfoUpgrade librbd-develUpgrade python3-rgw-debuginfoUpgrade ceph-debuginfoUpgrade librados-develUpgrade libradosstriper1-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-iscsiUpgrade python-cephfsUpgrade ceph-base-debuginfoUpgrade libcephfs-develUpgrade ceph-radosgwUpgrade ceph-mds-debuginfoUpgrade ceph-commonUpgrade ceph-mgr-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-fuseUpgrade rbd-mirrorUpgrade rbd-nbdUpgrade python-rgwUpgrade python3-rbd-debuginfoUpgrade ceph-selinuxUpgrade python-ceph-argparseUpgrade rbd-mirror-debuginfoUpgrade libtcmuUpgrade ceph-fuse-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-prometheus-alertsUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-rookUpgrade python3-rgwUpgrade ceph-mgr-dashboardUpgrade python3-rbdUpgrade ceph-osdUpgrade ceph-fuseUpgrade librbd-develUpgrade cephadmUpgrade rados-objclass-develUpgrade ceph-mgr-cephadmUpgrade librados2Upgrade librgw2Upgrade cephUpgrade libradospp-develUpgrade ceph-baseUpgrade rbd-fuseUpgrade ceph-testUpgrade python3-cephfsUpgrade ceph-mgr-k8seventsUpgrade rbd-mirrorUpgrade ceph-mgr-diskprediction-localUpgrade rbd-nbdUpgrade ceph-mdsUpgrade ceph-immutable-object-cacheUpgrade librados-develUpgrade ceph-grafana-dashboardsUpgrade ceph-commonUpgrade python3-ceph-argparseUpgrade librbd1Upgrade ceph-mgr-modules-coreUpgrade libcephfs-develUpgrade ceph-monUpgrade libcephfs2Upgrade ceph-mgrUpgrade ceph-radosgwUpgrade cephfs-shellUpgrade librgw-develUpgrade python3-radosUpgrade python3-ceph-common | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade ceph-mgr-cephadmUpgrade ceph-mgr-modules-coreUpgrade radosgwUpgrade ceph-commonUpgrade ceph-mgr-diskprediction-localUpgrade ceph-baseUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgrUpgrade ceph-mgr-dashboardUpgrade cephUpgrade ceph-mgr-rookUpgrade cephadm | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub