A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | May 26, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 26, 2021 |
| Centos_linux | — | Upgrade ceph-mgr-debuginfoUpgrade ceph-selinuxUpgrade tcmu-runnerUpgrade ceph-iscsiUpgrade ceph-ansibleUpgrade ceph-radosgwUpgrade librados-devel-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python3-cephfs-debuginfoUpgrade python3-rbd-debuginfoUpgrade python-rgwUpgrade ceph-common-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-test-debuginfoUpgrade libradosstriper1Upgrade ceph-base-debuginfoUpgrade ceph-fuseUpgrade librbd-develUpgrade rbd-nbd-debuginfoUpgrade python3-rgw-debuginfoUpgrade python-ceph-argparseUpgrade libradosstriper1-debuginfoUpgrade python3-rgwUpgrade libcephfs-develUpgrade librgw2-debuginfoUpgrade ceph-mdsUpgrade ceph-commonUpgrade ceph-baseUpgrade python3-radosUpgrade ceph-debuginfoUpgrade libcephfs2-debuginfoUpgrade rbd-mirrorUpgrade libtcmuUpgrade librgw2Upgrade libradospp-develUpgrade librados-develUpgrade ceph-grafana-dashboardsUpgrade ceph-debugsourceUpgrade ceph-mon-debuginfoUpgrade python-cephfsUpgrade python3-cephfsUpgrade python3-ceph-argparseUpgrade python3-rados-debuginfoUpgrade ceph-osd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade python3-rbdUpgrade rbd-nbdUpgrade ceph-fuse-debuginfoUpgrade librgw-develUpgrade libcephfs2 | Jun 16, 2021 | May 27, 2021 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | May 27, 2021 |
| Redhat_linux | — | Upgrade librgw2-debuginfoUpgrade libcephfs2Upgrade python3-ceph-argparseUpgrade ceph-mdsUpgrade libcephfs2-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-ansibleUpgrade python3-rados-debuginfoUpgrade ceph-baseUpgrade ceph-osd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade python3-radosUpgrade python3-rbdUpgrade python3-cephfs-debuginfoUpgrade libradosstriper1Upgrade ceph-grafana-dashboardsUpgrade librgw-develUpgrade tcmu-runnerUpgrade ceph-debugsourceUpgrade librgw2Upgrade python3-rgwUpgrade libradospp-develUpgrade python3-cephfsUpgrade ceph-mon-debuginfoUpgrade ceph-selinuxUpgrade python3-rgw-debuginfoUpgrade ceph-commonUpgrade libtcmuUpgrade rbd-mirror-debuginfoUpgrade python3-rbd-debuginfoUpgrade python-cephfsUpgrade rbd-nbdUpgrade ceph-base-debuginfoUpgrade librbd-develUpgrade ceph-fuse-debuginfoUpgrade ceph-iscsiUpgrade ceph-common-debuginfoUpgrade libradosstriper1-debuginfoUpgrade librados-develUpgrade python-ceph-argparseUpgrade rbd-mirrorUpgrade ceph-mgr-debuginfoUpgrade librados-devel-debuginfoUpgrade python-rgwUpgrade ceph-fuseUpgrade ceph-debuginfoUpgrade ceph-radosgwUpgrade libcephfs-develUpgrade ceph-mds-debuginfo | Jun 16, 2021 | May 27, 2021 |
| Suse | — | Upgrade ceph-osdUpgrade python3-rgwUpgrade ceph-mgr-rookUpgrade ceph-mdsUpgrade librbd-develUpgrade ceph-mgr-cephadmUpgrade rbd-nbdUpgrade ceph-fuseUpgrade python3-cephfsUpgrade libradospp-develUpgrade rbd-fuseUpgrade ceph-mgr-k8seventsUpgrade python3-rbdUpgrade rbd-mirrorUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-baseUpgrade ceph-testUpgrade ceph-prometheus-alertsUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-diskprediction-localUpgrade cephUpgrade librgw2Upgrade ceph-immutable-object-cacheUpgrade rados-objclass-develUpgrade librados2Upgrade cephadmUpgrade librados-develUpgrade ceph-monUpgrade ceph-commonUpgrade ceph-radosgwUpgrade ceph-mgrUpgrade libcephfs2Upgrade librgw-develUpgrade python3-ceph-commonUpgrade ceph-grafana-dashboardsUpgrade libcephfs-develUpgrade cephfs-shellUpgrade python3-radosUpgrade librbd1Upgrade ceph-mgr-modules-coreUpgrade python3-ceph-argparse | Jun 3, 2021 | May 27, 2021 |
| Ubuntu | — | Upgrade cephadmUpgrade ceph-baseUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-k8seventsUpgrade ceph-mgrUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-diskprediction-localUpgrade cephUpgrade ceph-commonUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-modules-coreUpgrade radosgw | Jun 25, 2021 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub