« Volver al listado

CVE-2020-27839

Estado: ModificadaMedia (5.4)—

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Ceph

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-27839",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ceph-dashboard",
          "versions": [
            {
              "status": "affected",
              "version": "ceph-dashboard 14.2.17, ceph-dashboard 15.2.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-26T22:15:07.863",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901330",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901330",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo en ceph-dashboard. El programa JSON Web Token (JWT) usado para la autenticación del usuario es almacenada en la aplicación frontend en el almacenamiento local del navegador, que es potencialmente vulnerable a atacantes por medio de ataques de tipo XSS. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos"
    }
  ],
  "lastModified": "2026-06-17T03:09:42.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "932EE726-C7E2-4185-A6C2-A678FB166399",
              "versionEndExcluding": "14.2.17"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "509E08EA-73F2-4311-8526-DE79215F2F2D",
              "versionEndExcluding": "15.2.9",
              "versionStartIncluding": "15.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}