CVE-2024-48916

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-489177.5PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXECVE-2024-489188.1RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain aCVE-2024-489199.2Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal CCVE-2024-48925.4The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and incCVE-2024-489209.1PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. ThiCVE-2024-489212.7Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the CVE-2024-489248.7### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attacCVE-2024-489256.5Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior toCVE-2024-489263.1Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch CVE-2024-489274.6Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13CVE-2024-489287.5Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuratioCVE-2024-489294.2Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x br