PT-2023-31258 · Quay · Quay

Avinash Hanwate + 1 · Publicado 2023-09-18 · Atualizado 2023-12-13 · CVE-2023-4956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Quay (affected versions not specified)

Description A flaw was found in Quay, where clickjacking allows an attacker to trick a user into clicking on a button or link on another page. The config-editor page is vulnerable to clickjacking, which could allow an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance. Clickjacking is a technique used by attackers to trick users into clicking on something different from what they intend, by using multiple transparent or opaque layers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2023-4956

Produtos afetados

Quay

Referências · 6

• https://access.redhat.com/security/cve/CVE-2023-4956 · Aviso do Fabricante
• https://t.me/cvenotify/63413 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-4956 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1703980982372606288 · Publicação no Twitter
• https://bugzilla.redhat.com/show_bug.cgi?id=2238886 · Nota
• https://osv.dev/vulnerability/CVE-2023-4956 · Aviso do Fabricante