PT-2021-11426 · Unknown+5 · Ceph-Dashboard+5

Published 2021-02-25 · Updated 2024-06-15 · CVE-2020-27839

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ceph-dashboard (affected versions not specified)

Description: A flaw was found in the way the JSON Web Token (JWT) used for user authentication is stored. The token is stored by the frontend application in the browser's localStorage, making it potentially vulnerable to attackers via XSS attacks. The highest threat from this issue is to data confidentiality and integrity.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

ALT-PU-2021-1401

ALT-PU-2021-1522

ALT-PU-2021-1748

CVE-2020-27839

MGASA-2021-0126

OPENSUSE-SU-2021:0544-1

OPENSUSE-SU-2021_0544-1

OPENSUSE-SU-2024:11652-1

RHSA-2021:2445

SUSE-SU-2021:1108-1

SUSE-SU-2021:1472-1

SUSE-SU-2021:1473-1

SUSE-SU-2021_1473-1

USN-4998-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Ceph-Dashboard

References · 65

• https://osv.dev/vulnerability/openSUSE-SU-2024:11652-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27839 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4998-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3509 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0126 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27839 · Security Note
• https://ubuntu.com/security/CVE-2020-25678 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27839 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:1472-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0544-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1901330 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3524 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4998-1 · Vendor Advisory