CVE-2021-3509

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.

• CWE-79

• https://bugzilla.redhat.com/show_bug.cgi?id=1950116Issue Tracking, Patch, Vendor Advisory
• https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409Exploit, Third Party Advisory
• https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27bPatch, Third Party Advisory
• https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10caPatch, Third Party Advisory
• https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1950116Issue Tracking, Patch, Vendor Advisory
• https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409Exploit, Third Party Advisory
• https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27bPatch, Third Party Advisory
• https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10caPatch, Third Party Advisory
• https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27Patch, Third Party Advisory

Published

May 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35084Possible out of bound read due to lack of length check of da…7.1
• CVE-2021-35085Possible buffer overflow due to lack of buffer length check …7.1
• CVE-2021-35086Possible buffer over read due to improper validation of SIB …7.5
• CVE-2021-35087Possible null pointer access due to improper validation of s…7.5
• CVE-2021-35088Possible out of bound read due to improper validation of IE …9.1
• CVE-2021-35089Possible buffer overflow due to lack of input IB amount vali…7.8
• CVE-2021-35090Possible hypervisor memory corruption due to TOC TOU race co…7.8
• CVE-2021-35091Possible out of bounds read due to improper typecasting whil…7.8
• CVE-2021-35092Processing DCB/AVB algorithm with an invalid queue index fro…6.7
• CVE-2021-35093Possible memory corruption in BT controller when it receives…6.5
• CVE-2021-35094Improper verification of timeout-based authentication in ide…7.8
• CVE-2021-35095Improper serialization of message queue client registration …7