Lucene search

K

10 matches found

CVE
CVE
added 2020/11/23 10:15 p.m.291 views

CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Cep...

8.8CVSS6.9AI score0.01978EPSS
CVE
CVE
added 2020/12/18 9:15 p.m.263 views

CVE-2020-27781

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface dri...

7.1CVSS6.8AI score0.00043EPSS
CVE
CVE
added 2021/05/26 10:15 p.m.248 views

CVE-2020-27839

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integ...

5.4CVSS5.3AI score0.00335EPSS
CVE
CVE
added 2021/05/18 12:15 p.m.243 views

CVE-2021-3531

A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.

5.3CVSS5.6AI score0.00257EPSS
CVE
CVE
added 2021/05/17 5:15 p.m.242 views

CVE-2021-3524

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection...

6.5CVSS6.7AI score0.00451EPSS
CVE
CVE
added 2021/01/08 6:15 p.m.235 views

CVE-2020-25678

A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.

4.4CVSS4.9AI score0.00015EPSS
CVE
CVE
added 2019/01/15 9:29 p.m.218 views

CVE-2018-14662

It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.

5.7CVSS5.7AI score0.00118EPSS
CVE
CVE
added 2019/01/15 6:29 p.m.214 views

CVE-2018-16846

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.

6.5CVSS6.2AI score0.04862EPSS
CVE
CVE
added 2018/07/31 7:29 p.m.76 views

CVE-2016-8626

A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.

6.8CVSS6.2AI score0.02873EPSS
CVE
CVE
added 2018/03/19 9:29 p.m.74 views

CVE-2018-7262

In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.

7.5CVSS7.3AI score0.00674EPSS