Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-3509

EPSS 0.60% · P70
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-3509

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Ceph跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Ceph是美国红帽（Red Hat）公司的一套Linux PB级分布式文件系统。该系统的主要目标是设计成基于POSIX（可移植操作系统接口）的没有单点故障的分布式文件系统，使数据能容错和无缝的复制。 Red Hat Ceph 存在跨站脚本漏洞，该漏洞源于对通过JWT令牌在HTTP cookie中传递的用户提供的数据没有进行充分的无害化处理。远程攻击者可利用该漏洞可以在脆弱网站的上下文中在用户的浏览器中注入和执行任意的HTML和脚本代码。以下产品及版本受到影响：Ceph: 14.0.0, 1
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-ceph-dashboard as shipped in Red Hat Ceph Storage 4 -

II. Public POCs for CVE-2021-3509

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-3509

请登录查看更多情报信息。

Same Patch Batch · n/a · 2021-05-26 · 92 CVEs total

CVE-2021-292525.4 MEDIUMRSA Archer 跨站脚本漏洞
CVE-2021-292535.1 MEDIUMRSA Archer 安全漏洞
CVE-2021-22745Triconex Model 3009 MP 代码问题漏洞
CVE-2021-22705Schneider Electric 缓冲区错误漏洞
CVE-2021-22731Schneider Electric 授权问题漏洞
CVE-2021-22735Schneider Electric homeLYnk和spaceLYnk 数据伪造问题漏洞
CVE-2021-22733Schneider Electric homeLYnk和spaceLYnk 安全漏洞
CVE-2021-22734Schneider Electric spaceLYnk和homeLYnk 数据伪造问题漏洞
CVE-2021-22732Schneider Electric homeLYnk和spaceLYnk 安全漏洞
CVE-2021-22742Triconex Model 3009 MP 代码问题漏洞
CVE-2021-22743Triconex Model 3009 MP 代码问题漏洞
CVE-2021-22744Triconex Model 3009 MP 代码问题漏洞
CVE-2021-22740Schneider Electric homeLYnk和spaceLYnk 信息泄露漏洞
CVE-2021-22746Triconex Model 3009 MP 代码问题漏洞
CVE-2021-22747Triconex Model 3009 MP 代码问题漏洞
CVE-2020-22021FFmpeg 缓冲区错误漏洞
CVE-2021-25643Couchbase Server 安全漏洞
CVE-2020-22024FFmpeg 安全漏洞
CVE-2020-22026FFmpeg 安全漏洞
CVE-2021-3548dmg2img 缓冲区错误漏洞

Showing top 20 of 92 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ceph-dashboard
Same vendor: n/a
Same weakness: CWE-79

V. Comments for CVE-2021-3509

No comments yet

Leave a comment