Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Red Hat Ceph跨站脚本漏洞
Vulnerability Description
Red Hat Ceph是美国红帽（Red Hat）公司的一套Linux PB级分布式文件系统。该系统的主要目标是设计成基于POSIX（可移植操作系统接口）的没有单点故障的分布式文件系统，使数据能容错和无缝的复制。 Red Hat Ceph 存在跨站脚本漏洞，该漏洞源于对通过JWT令牌在HTTP cookie中传递的用户提供的数据没有进行充分的无害化处理。远程攻击者可利用该漏洞可以在脆弱网站的上下文中在用户的浏览器中注入和执行任意的HTML和脚本代码。以下产品及版本受到影响：Ceph: 14.0.0, 1
CVSS Information
N/A
Vulnerability Type
N/A