PT-2024-37226 · Quay · Quay

Published 2024-06-12 · Updated 2024-10-04 · CVE-2024-5891

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Quay (affected versions not specified)

Description: A vulnerability was found in Quay, where an attacker can use an OAuth token to authenticate despite not having access to the organization from which the application was created, if they obtain the client ID for an application. This issue is limited to authentication and not authorization. However, in configurations where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1390

Related Identifiers

CVE-2024-5891

Affected Products

Quay

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-5891 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5891 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2283879 · Note
• https://t.me/cvenotify/83012 · Telegram Post
• https://t.me/cvenotify/97018 · Telegram Post
• https://t.me/cvenotify/96129 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2024-5891 · Note