A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade libcephfs2Upgrade libcephfs2-debuginfoUpgrade libradosstriper1-debuginfoUpgrade libcephfs-develUpgrade python3-rgwUpgrade ceph-fuse-debuginfoUpgrade librados-develUpgrade librgw-develUpgrade rbd-nbd-debuginfoUpgrade ceph-debuginfoUpgrade librgw2-debuginfoUpgrade python-ceph-argparseUpgrade ceph-osd-debuginfoUpgrade python3-radosUpgrade python3-rados-debuginfoUpgrade python3-ceph-argparseUpgrade rbd-mirrorUpgrade python3-rgw-debuginfoUpgrade python3-cephfsUpgrade libradospp-develUpgrade libtcmuUpgrade librgw2Upgrade ceph-baseUpgrade ceph-commonUpgrade ceph-debugsourceUpgrade ceph-grafana-dashboardsUpgrade rbd-fuse-debuginfoUpgrade ceph-mon-debuginfoUpgrade ceph-mdsUpgrade python3-rbdUpgrade rbd-nbdUpgrade python-cephfsUpgrade ceph-common-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python3-rbd-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-mds-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-iscsiUpgrade ceph-mgr-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-radosgwUpgrade python-rgwUpgrade tcmu-runnerUpgrade ceph-selinuxUpgrade ceph-ansibleUpgrade ceph-fuseUpgrade librbd-develUpgrade libradosstriper1Upgrade python3-cephfs-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade ceph-ansibleUpgrade python3-cephfs-debuginfoUpgrade libcephfs2-debuginfoUpgrade python3-rbdUpgrade rbd-nbd-debuginfoUpgrade ceph-debugsourceUpgrade ceph-radosgw-debuginfoUpgrade python3-radosUpgrade ceph-osd-debuginfoUpgrade librgw2Upgrade libcephfs2Upgrade python3-rgwUpgrade tcmu-runnerUpgrade librgw-develUpgrade ceph-test-debuginfoUpgrade ceph-baseUpgrade librgw2-debuginfoUpgrade ceph-grafana-dashboardsUpgrade python3-rados-debuginfoUpgrade ceph-mon-debuginfoUpgrade ceph-mdsUpgrade python3-ceph-argparseUpgrade rbd-fuse-debuginfoUpgrade libradosstriper1Upgrade python3-cephfsUpgrade libradospp-develUpgrade librados-develUpgrade librbd-develUpgrade ceph-debuginfoUpgrade rbd-mirror-debuginfoUpgrade libtcmuUpgrade python3-rbd-debuginfoUpgrade ceph-base-debuginfoUpgrade libradosstriper1-debuginfoUpgrade ceph-iscsiUpgrade rbd-nbdUpgrade libcephfs-develUpgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-mgr-debuginfoUpgrade rbd-mirrorUpgrade ceph-commonUpgrade ceph-radosgwUpgrade python-cephfsUpgrade ceph-fuse-debuginfoUpgrade ceph-fuseUpgrade python3-rgw-debuginfoUpgrade librados-devel-debuginfoUpgrade python-rgwUpgrade python-ceph-argparse | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-grafana-dashboardsUpgrade libcephfs2Upgrade python3-ceph-argparseUpgrade cephfs-shellUpgrade ceph-mgr-modules-coreUpgrade librbd1Upgrade python3-ceph-commonUpgrade ceph-commonUpgrade python3-radosUpgrade libcephfs-develUpgrade ceph-mgrUpgrade ceph-monUpgrade ceph-radosgwUpgrade librgw-develUpgrade librados-develUpgrade python3-rbdUpgrade ceph-osdUpgrade ceph-immutable-object-cacheUpgrade librgw2Upgrade python3-rgwUpgrade rbd-nbdUpgrade rbd-mirrorUpgrade ceph-mgr-rookUpgrade ceph-mdsUpgrade librbd-develUpgrade ceph-mgr-cephadmUpgrade cephadmUpgrade ceph-testUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-prometheus-alertsUpgrade ceph-baseUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-dashboardUpgrade python3-cephfsUpgrade libradospp-develUpgrade librados2Upgrade cephUpgrade ceph-fuseUpgrade rbd-fuseUpgrade ceph-mgr-k8seventsUpgrade rados-objclass-devel | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade ceph-mgrUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-rookUpgrade cephUpgrade cephadmUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-baseUpgrade ceph-mgr-cephadmUpgrade radosgwUpgrade ceph-commonUpgrade ceph-mgr-modules-core | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub