Published: 23/04/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linuxfoundation ceph
redhat ceph storage 3.0
redhat openshift container platform 4.2
redhat ceph storage 4.0
fedoraproject fedora 31
canonical ubuntu linux 18.04
canonical ubuntu linux 16.04
debian debian linux 9.0

Synopsis Moderate: Red Hat Ceph Storage 41 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Ceph Storage 41Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ...

Debian Bug report logs - #956142 ceph: CVE-2020-1760 Package: src:ceph; Maintainer for src:ceph is Ceph Packaging Team <team+ceph@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 7 Apr 2020 19:30:02 UTC Severity: important Tags: security, upstream Found in versions ceph/1428-2 ...

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3 This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input If the attacker knows the path to a publicly readable object on any RGW cluster and the object is at least large enough to cover the ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2020-1760 ceph: header-splitting in RGW GetObject has a possible XSS   ...

CWE-79 https://www.openwall.com/lists/oss-security/2020/04/07/1 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760 https://usn.ubuntu.com/4528-1/https://security.gentoo.org/glsa/202105-39 https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/https://access.redhat.com/errata/RHSA-2020:3003 https://nvd.nist.gov https://security.archlinux.org/CVE-2020-1760

CVE-2020-1760

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect