CVE-2021-3509 - log back

CVE-2021-3509 edited at 14 May 2021 19:35:07
Description
- A security issue was found in ceph before version . In order to make the JWT token inaccessible through cross-site scripting (XSS), it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.
+ A security issue was found in ceph before version 15.2.12. In order to make the JWT token inaccessible through cross-site scripting (XSS), it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.
CVE-2021-3509 edited at 14 May 2021 19:30:32
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Cross-site scripting
Description
+ A security issue was found in ceph before version . In order to make the JWT token inaccessible through cross-site scripting (XSS), it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=1950116
+ https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b
CVE-2021-3509 created at 14 May 2021 19:28:07
Severity
+ Unknown
Remote
+ Unknown
Type
+ Unknown
Description
References
Notes