CVE-2024-48916: falha de alta gravidade em ceph
Ceph is vulnerable to authentication bypass through RadosGW
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.2%
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
ceph · cephCVEs relacionadas — ceph
No mesmo produto, das mais perigosas para as menos.
CVE-2024-47866HIGHRGW DoS attack with empty HTTP header in S3 object copyEPSS 0.5%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-39944HIGHCeph: CephX AES Authentication errorEPSS 0.3%CVE-2026-50152CRITICALCeph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only usersEPSS 0.2%CVE-2025-52555MEDIUMCephFS Permission Escalation Vulnerability in Ceph Fuse mounted FSEPSS 0.2%CVE-2025-30156HIGHCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgeryEPSS 0.1%