PT-2024-3593 · Quay · Quay

Marco Benatto · Published 2024-04-10 · Updated 2024-04-26 · CVE-2024-3624

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Quay (affected versions not specified)

Description: A flaw in Quay's mirror-registry allows a malicious actor with access to the config.yaml file to gain unauthorized access to Quay's database. The issue is related to the storage of critical information in plain-text in the config.yaml file of the Jinja template engine. This could enable a remote attacker to exploit the flaw and obtain unauthorized access to sensitive information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-313

CWE-256

Related Identifiers

BDU:2024-03904

CVE-2024-3624

Affected Products

Quay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-3624 · Security Note
• https://bdu.fstec.ru/vul/2024-03904 · Security Note
• https://vuldb.com/ru/?id.260384 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2274407 · Note
• https://access.redhat.com/security/cve/CVE-2024-3624 · Note