CVE-2020-1760
- State
- Published
- Severity
- 5.8 Medium
- Published
- Apr 23, 2020
- Updated
- Aug 4, 2024
- Reserved
- Nov 27, 2019
Description
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ceph[UNKNOWN] |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760
- https://www.openwall.com/lists/oss-security/2020/04/07/1
- FEDORA-2020-81b9c6cddcvendor-advisory
- USN-4528-1vendor-advisory
- GLSA-202105-39vendor-advisory
- [debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security updatemailing-list
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.