MediumFix available
ceph — security advisory
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
- Products
- ceph
- Affected versions
- Not specified
- Fixed versions
- 14.2.9-1
- CVEs
- CVE-2020-1760
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:05 UTC · Revision 1
Source evidence
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
osv:DEBIAN-CVE-2020-1760
ceph
Fixed versions: 14.2.9-1
ceph
Fixed versions: 14.2.9-1
ceph
Fixed versions: 14.2.9-1
Complete source record
{
"id": "36aae7324498f13bf362955f614998b97a5a6e8753d7260feeccd988ce3719eb",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-1760",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-1760",
"summary": "A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.",
"evidence": "osv:DEBIAN-CVE-2020-1760",
"products": [
{
"name": {
"value": "ceph",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.9-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.9-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.9-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2020-1760",
"aliases": [
"DEBIAN-CVE-2020-1760"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.9-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-1760.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.9-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-1760.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.9-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-1760.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:01:42.698365289Z",
"provider": "osv",
"upstream": [
"CVE-2020-1760"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-1760"
]
},
"related_cves": [
{
"value": "CVE-2020-1760",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 451793,
"published_at": "2020-04-23T15:15:14.607+00:00"
}