CVE-2020-1760: A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3

Medium severity · published Apr 23, 2020

CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3

6.1

CVSS

1.6%

EPSS

On KEV

Description

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Ceph · Linuxfoundation

before 14.2.21 · source: NVD

Ceph Storage · Redhat

3.0; 4.0 · source: NVD

Debian Linux · Debian

9.0 · source: NVD

Fedora · Fedoraproject

31 · source: NVD

Openshift Container Platform · Redhat

4.2 · source: NVD

Ubuntu Linux · Canonical

16.04; 18.04 · source: NVD

Affected product

Ubuntu Linux

Canonical

All Ubuntu Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-1760

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-1760

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760

Mailing List

https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html

lists.debian.org

https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/

Third Party Advisory

https://security.gentoo.org/glsa/202105-39

Third Party Advisory

https://usn.ubuntu.com/4528-1/