Skip to content
OpenAdvisories
Medium WID-SEC-2023-2377 2 CVEs

Red Hat Quay: Mehrere Schwachstellen

Published Sep 17, 2023 · Updated Sep 17, 2023 · de-DE

Vendor: Red Hat Product: Quay <= 3 Platform: Linux

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat Quay ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Red Hat Quay ist eine verteilte und hochverfügbare Container Image Registry.

Vulnerabilities 2

  • Medium 6.5
    CVE-2023-4956

    Quay: clickjacking on config-editor page severity

    A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected t…

    Red Hat Red Hat Quay 3
  • Medium 6.5
    CVE-2023-4959

    Quay: cross-site request forgery (csrf) on config-editor page

    A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure …

    Red Hat Red Hat Quay 3

Revision history

  1. #1

    Initiale Fassung

References