Medium severity · published May 27, 2021
CVE-2021-3509
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3509
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1950116
Exploit
https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409
Patch
https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b
Patch
https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10ca
Patch
https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27
More from Ceph Storage
9.8
CVE-2022-26148
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix
9.8
CVE-2021-20236
A flaw was found in the ZeroMQ server in versions before 4.3.3
9.8
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode
9.8
CVE-2018-15727
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of…
9.1
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system