6.1
CVE-2020-1760
- EPSS 0.29%
- Published 23.04.2020 15:15:14
- Last modified 21.11.2024 05:11:19
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
Data is provided by the National Vulnerability Database (NVD)
Linuxfoundation ≫ Ceph Version < 14.2.21
Redhat ≫ Ceph Storage Version3.0
Redhat ≫ Ceph Storage Version4.0
Redhat ≫ Openshift Container Platform Version4.2
Fedoraproject ≫ Fedora Version31
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.519 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
| secalert@redhat.com | 5.8 | 1.6 | 3.7 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.