CVE Feed

    Dashboard / CVE / CVE-2020-27839

    CVE-2020-27839

    A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

    Published:Mar 13, 2020
    Last Modified:Nov 21, 2024
    EPS:May 26, 2021
    EPSS Score:0.00335
    CVSS Score:5.4

    Affected Products

    Vendor
    Redhat
    Product
    Ceph
    Vendor
    Redhat
    Product
    Ceph Storage

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-47866 (CVSS 7.5) — Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using …
    CVE-2022-3650 (CVSS 7.8) — A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileg…
    CVE-2021-3531 (CVSS 5.3) — A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for…
    CVE-2021-3524 (CVSS 6.5) — A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vul…
    CVE-2020-27781 (CVSS 7.1) — User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in po…
    CVE-2020-25678 (CVSS 4.4) — A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. Thi…
    CVE-2020-25660 (CVSS 8.8) — A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it d…
    CVE-2018-16889 (CVSS 5.5) — Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of e…
    CVE-2018-16846 (CVSS 6.5) — It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service ag…
    CVE-2018-14662 (CVSS 5.7) — It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High