PT-2024-9892 · Ceph+4 · Ceph Radosgw+4

Published 2024-11-02 · Updated 2026-03-20 · CVE-2024-48916

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Ceph RadosGW (affected versions not specified)

Description: The issue is related to insufficient authentication of data when handling JWT tokens, which can be exploited by a remote attacker to bypass the authentication procedure. This can lead to unauthorized access. There have been no reported real-world incidents or estimated numbers of affected devices provided.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2025-5585

AZL-65996

AZL-66005

BDU:2025-00001

BIT-CEPH-2024-48916

CVE-2024-48916

DSA-5825-1

GHSA-5G9M-MMP6-93MQ

MGASA-2025-0011

OESA-2025-1206

OESA-2025-1207

OESA-2025-1208

OESA-2025-1209

RHSA-2024:10956

RHSA-2025:4238

RHSA-2025:4664

USN-7182-1

Affected Products

Alt Linux

Ceph Radosgw

Linuxmint

Red Os

Ubuntu

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48916.json · Exploit
• https://cve.org/CVERecord?id=CVE-2024-48916 · Security Note
• https://advisories.mageia.org/MGASA-2025-0011.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0011 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1208 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/715596 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48916 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-48916 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-48916 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1206 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66005 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1209 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-48916 · Vendor Advisory