CVE-2020-10753 MEDIUM

CVE-2020-10753

Vendor Red Hat

Product Red Hat Ceph Storage

Weakness CWE-113 · HTTP response splitting

Published June 26, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

Key dates

02Disclosure timeline

June 26, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-10753 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/113.html

Related vulnerabilities

04Related CVE

CVE-2024-24795 Apache HTTP Server: HTTP Response Splitting in multiple modules CVE-2022-37436 Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting CVE-2026-23686 CRLF Injection vulnerability in SAP NetWeaver Application Server Java CVE-2023-0508 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab CVE-2026-34715 ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)