Log in Start free

Vulnerability · Published Jun 26, 2020 · Assigned by redhat

CVE-2020-10753

Medium 5.4

In plain English

A medium-severity security flaw in Red Hat Ceph Storage from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.5%top 26.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ceph14.2.15-1DEBIAN-CVE-2020-10753
Debian:13ceph14.2.15-1DEBIAN-CVE-2020-10753
Debian:14ceph14.2.15-1DEBIAN-CVE-2020-10753

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ceph Storage versions 3.x and 4.x

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References