PT-2020-6261 · Ceph+3 · Ceph Object Gateway+3

Robin H. Johnson + 1 · Published 2020-04-06 · Updated 2026-03-20 · CVE-2020-1760

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ceph Object Gateway (affected versions not specified)

Description The issue is related to the Ceph Object Gateway, which supports requests from anonymous users in Amazon S3. This could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. The flaw may allow a remote attacker to impact data integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-1757

ALT-PU-2020-1769

ALT-PU-2020-2845

ALT-PU-2021-1830

ALT-PU-2021-2332

BDU:2021-03733

BIT-CEPH-2020-1760

CVE-2020-1760

DLA-2171-1

DLA-2735-1

DLA-3629-1

OESA-2021-1317

OPENSUSE-SU-2020:0494-1

OPENSUSE-SU-2020_0494-1

OPENSUSE-SU-2024:10676-1

RHSA-2020:3003

SUSE-SU-2020:0930-1

SUSE-SU-2020:0962-1

SUSE-SU-2020_0962-1

USN-4528-1

Affected Products

Alt Linux

Ceph Object Gateway

Suse

Ubuntu

References · 45

• https://bdu.fstec.ru/vul/2021-03733 · Security Note
• https://usn.ubuntu.com/4528-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0930-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10753 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/04/07/1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-1760 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2735-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3524 · Security Note
• https://security.gentoo.org/glsa/202105-39 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3629-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27781 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1760 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0494-1 · Vendor Advisory