CVE-2020-27839: XSS
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
Issue:
The JSON Web Token (JWT) used for user authentication is stored the by the frontend application in the browser’s localStorage.
Suggestion:
Do not store sensitive data in HTML5 localStorage, not even temporarily. Use cookies with appropriate security flags (secure, HttpOnly, SameSite).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27839?
CVE-2020-27839 is a vulnerability in ceph-dashboard that allows attackers to potentially access user authentication data via XSS attacks.
What is the severity of CVE-2020-27839?
The severity of CVE-2020-27839 is medium (5.4).
How does CVE-2020-27839 affect data confidentiality?
CVE-2020-27839 poses a threat to data confidentiality.
How can I fix CVE-2020-27839?
To fix CVE-2020-27839, upgrade to ceph-dashboard version 14.2.17 or 15.2.9, depending on your current version.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-27839?
The Common Weakness Enumeration (CWE) ID for CVE-2020-27839 is 79 and 522.