Medium severity · published May 26, 2021
CVE-2020-27839
A flaw was found in ceph-dashboard
5.4
CVSS
2.4%
EPSS
No
On KEV
Description
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Redhat
before 14.2.17; 15.2.0 before 15.2.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27839
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1901330
More from Ceph
8.8
CVE-2020-25660
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to…
7.8
CVE-2022-3650
A privilege escalation flaw was found in Ceph
7.5
CVE-2024-47866
RGW DoS attack with empty HTTP header in S3 object copy
7.5
CVE-2018-16889
Ceph does not properly sanitize encryption keys in debug logging for v4 auth
7.5
CVE-2018-1128
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack