CVE-2021-3509CWE-79

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component

published May 26, 2021

CVSS
—
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01700 · 77.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-05-26T23:56Z
EPSS history
Timeline
  • 26 MAY 23:56Z
    A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component
    cvelistv5