Cross-site scripting in ceph-dashboard
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
Why it matters now
EPSS 0.017 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 3 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ceph-dashboard | as shipped in Red Hat Ceph Storage 4 | — | No fix listed | CNA |
- ceph-dashboard Vendor— Affected as shipped in Red Hat Ceph Storage 4 Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2021:2445 Released 2021-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 4.2 Security and Bug Fix Update
- Red Hat Ceph Storage 4.2 MON ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +47
- Red Hat Ceph Storage 4.2 OSD ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +39
- Red Hat Ceph Storage 4.2 Tools ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 4.2 MON | Fixed | RHSA-2021:2445 |
| Red Hat Ceph Storage 4.2 OSD | Fixed | RHSA-2021:2445 |
| Red Hat Ceph Storage 4.2 Tools | Fixed | RHSA-2021:2445 |
Not affected: 4 products
- Red Hat Ceph Storage 4.2 MON
- Red Hat Ceph Storage 4.2 Tools
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3509
- 2026-10-03 Alias added: GHSA-g9cr-7jh8-qrmx
References
More Red Hat Ceph Storage vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-11213 Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass… CVSS 3.0CRITICAL 9.8
- TI-2022-09605 An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. CVSS 3.1CRITICAL 9.8
- TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
- TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2021-3509 · CVE Program
- CVE-2021-3509 · NVD
- FIRST EPSS
- GHSA-g9cr-7jh8-qrmx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3509 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences