A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade ceph-baseUpgrade rbd-nbd-debuginfoUpgrade libradospp-develUpgrade ceph-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-mon-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-osd-debuginfoUpgrade rbd-nbdUpgrade python3-rbdUpgrade python3-rgw-debuginfoUpgrade python-cephfsUpgrade rbd-mirrorUpgrade ceph-debugsourceUpgrade libtcmuUpgrade libcephfs-develUpgrade librados-develUpgrade librgw2-debuginfoUpgrade python-ceph-argparseUpgrade python3-radosUpgrade ceph-fuse-debuginfoUpgrade librgw2Upgrade libcephfs2-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-commonUpgrade libcephfs2Upgrade ceph-mdsUpgrade python3-ceph-argparseUpgrade python3-rgwUpgrade python3-cephfsUpgrade librgw-develUpgrade ceph-fuseUpgrade tcmu-runnerUpgrade ceph-radosgw-debuginfoUpgrade ceph-selinuxUpgrade python-rgwUpgrade libradosstriper1Upgrade ceph-test-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-common-debuginfoUpgrade python3-rbd-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-radosgwUpgrade rbd-mirror-debuginfoUpgrade ceph-base-debuginfoUpgrade librbd-develUpgrade ceph-ansibleUpgrade ceph-mgr-debuginfoUpgrade ceph-iscsi | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade ceph-base-debuginfoUpgrade python3-rbd-debuginfoUpgrade ceph-fuseUpgrade libtcmuUpgrade rbd-nbdUpgrade librados-devel-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-iscsiUpgrade ceph-debuginfoUpgrade libcephfs-develUpgrade librados-develUpgrade rbd-mirrorUpgrade libradosstriper1-debuginfoUpgrade librbd-develUpgrade python-cephfsUpgrade python-rgwUpgrade ceph-common-debuginfoUpgrade ceph-selinuxUpgrade rbd-mirror-debuginfoUpgrade ceph-radosgwUpgrade ceph-commonUpgrade python-ceph-argparseUpgrade ceph-mds-debuginfoUpgrade ceph-fuse-debuginfoUpgrade python3-rgw-debuginfoUpgrade librgw-develUpgrade python3-rados-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-baseUpgrade libradosstriper1Upgrade libradospp-develUpgrade python3-cephfsUpgrade ceph-mon-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade libcephfs2Upgrade ceph-mdsUpgrade python3-radosUpgrade python3-cephfs-debuginfoUpgrade tcmu-runnerUpgrade librgw2-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-ansibleUpgrade ceph-test-debuginfoUpgrade python3-rbdUpgrade ceph-debugsourceUpgrade rbd-fuse-debuginfoUpgrade libcephfs2-debuginfoUpgrade rbd-nbd-debuginfoUpgrade librgw2Upgrade python3-rgw | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-osdUpgrade librgw2Upgrade python3-rbdUpgrade ceph-mdsUpgrade ceph-mgr-k8seventsUpgrade ceph-prometheus-alertsUpgrade rbd-mirrorUpgrade ceph-mgr-diskprediction-cloudUpgrade cephUpgrade ceph-mgr-dashboardUpgrade librbd-develUpgrade rbd-fuseUpgrade ceph-mgr-cephadmUpgrade ceph-fuseUpgrade rados-objclass-develUpgrade libradospp-develUpgrade python3-cephfsUpgrade cephadmUpgrade ceph-mgr-diskprediction-localUpgrade librados2Upgrade ceph-baseUpgrade ceph-immutable-object-cacheUpgrade ceph-testUpgrade rbd-nbdUpgrade python3-rgwUpgrade ceph-mgr-rookUpgrade ceph-monUpgrade librados-develUpgrade ceph-mgr-modules-coreUpgrade python3-ceph-argparseUpgrade ceph-radosgwUpgrade ceph-mgrUpgrade libcephfs-develUpgrade python3-ceph-commonUpgrade ceph-grafana-dashboardsUpgrade ceph-commonUpgrade python3-radosUpgrade cephfs-shellUpgrade librgw-develUpgrade libcephfs2Upgrade librbd1 | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-cephadmUpgrade radosgwUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-diskprediction-localUpgrade cephUpgrade ceph-mgr-rookUpgrade ceph-baseUpgrade ceph-mgr-k8seventsUpgrade ceph-mgrUpgrade cephadmUpgrade ceph-mgr-dashboard | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub