Cross-site Scripting (XSS) Affecting ceph package, versions <16.2.4-0ubuntu1


Severity

Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU2204-CEPH-2781850
  • published21 May 2021
  • disclosed27 May 2021

Introduced: 21 May 2021

CVE-2021-3509  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade Ubuntu:22.04 ceph to version 16.2.4-0ubuntu1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ceph package and not the ceph package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.

CVSS Scores

version 3.1