DeutschShown in its original language — a full translation is planned for a future version.
Red Hat Ceph Storage: Mehrere Schwachstellen
view advisory published 2021-06-15
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Ceph Storage ausnutzen, um Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3509US | medium6.1 | — | ||
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, tok… | ||||
| CVE-2020-27839US | medium5.4 | — | ||
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially v… | ||||
| CVE-2021-20288US | high7.2 | — | ||
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reus… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2021:2445 vom 2021-06-15external
- Red Hat Security Advisory RHSA-2022:1394 vom 2022-04-19external
- Debian Security Advisory DLA-3629 vom 2023-10-23external
- Ubuntu Security Notice USN-4998-1 vom 2021-06-25external
- Ubuntu Security Notice USN-5128-1 vom 2021-11-01external
- WID-SEC-W-2023-2729 - CSAF Versionself
- WID-SEC-2023-2729 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan