CVE-2020-27839
published 2021-05-26CVE-2020-27839: A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
2.45%
82.6th percentile
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ceph | < ceph 14.2.21-1 (bookworm) | ceph 14.2.21-1 (bookworm) |
| debian | ceph | < ceph 14.2.18-1 (bookworm) | ceph 14.2.18-1 (bookworm) |
| redhat | ceph | < 14.2.17 | 14.2.17 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 15.2.12-0ubuntu0.20.04.1 | 15.2.12-0ubuntu0.20.04.1 |
| redhat | ceph | >= 15.2.0 < 15.2.9 | 15.2.9 |
| redhat | ceph_storage | — | — |
| redhat | ceph_storage | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph_storage | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph_storage | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph_storage | >= 0 < 14.2.21-1 | 14.2.21-1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
vendor_ubuntu4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2c8x-3ppx-9gj3: A flaw was found in ceph-dashboard
ghsa_unreviewed·2022-05-24
CVE-2020-27839 [MEDIUM] CWE-522 GHSA-2c8x-3ppx-9gj3: A flaw was found in ceph-dashboard
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
GHSA
GHSA-g9cr-7jh8-qrmx: A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
ghsa_unreviewed·2022-05-24·CVSS 5.4
CVE-2021-3509 [MEDIUM] CWE-79 GHSA-g9cr-7jh8-qrmx: A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
OSV
ceph vulnerabilities
osv·2021-06-25·CVSS 4.4
CVE-2020-25678 [MEDIUM] ceph vulnerabilities
ceph vulnerabilities
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
OSV
CVE-2021-3509: A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
osv·2021-05-27·CVSS 5.4
CVE-2021-3509 [MEDIUM] CVE-2021-3509: A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
OSV
CVE-2020-27839: A flaw was found in ceph-dashboard
osv·2021-05-26·CVSS 5.4
CVE-2020-27839 [MEDIUM] CVE-2020-27839: A flaw was found in ceph-dashboard
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-06-25·CVSS 4.4
CVE-2021-3509 [MEDIUM] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of se
Red Hat
ceph-dashboard: Cross-site scripting via token Cookie
vendor_redhat·2021-05-13·CVSS 5.4
CVE-2021-3509 [MEDIUM] CWE-79 ceph-dashboard: Cross-site scripting via token Cookie
ceph-dashboard: Cross-site scripting via token Cookie
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
A flaw was found in the Red Hat Ceph Storage Dashboard. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. The greatest threat to the system is for confidentiality, integrity, and availabilit
Debian
CVE-2021-3509: ceph - A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In respo...
vendor_debian·2021·CVSS 5.4
CVE-2021-3509 [MEDIUM] CVE-2021-3509: ceph - A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In respo...
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
Scope: local
bookworm: resolved (fixed in 14.2.21-1)
bullseye: resolved (fixed in 14.2.21-1)
forky: resolved (fixed in 14.2.21-1)
sid: resolved (fixed in 14.2.21-1)
trixie: resolved (fixed in 14.2.21-1)
Red Hat
ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
vendor_redhat·2020-03-13·CVSS 5.4
CVE-2020-27839 [MEDIUM] CWE-522 ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: * Red Hat Ceph Storage 3 is not affected as it does not use authent
Debian
CVE-2020-27839: ceph - A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authe...
vendor_debian·2020·CVSS 5.4
CVE-2020-27839 [MEDIUM] CVE-2020-27839: ceph - A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authe...
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Scope: local
bookworm: resolved (fixed in 14.2.18-1)
bullseye: resolved (fixed in 14.2.18-1)
forky: resolved (fixed in 14.2.18-1)
sid: resolved (fixed in 14.2.18-1)
trixie: resolved (fixed in 14.2.18-1)
No detection rules found.
No public exploits indexed.
2021-05-26
Published