CVE-2021-3524CWE-20

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21

published May 17, 2021

CVSS
—
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01604 · 75.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-05-17T00:00Z
EPSS history
Timeline
  • 17 MAY 00:00Z
    A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21
    cvelistv5