CVE-2019-3865 - quay: Stored XSS in super user function

Back Back to CVE browser

MEDIUM

quay: Stored XSS in super user function

Published Jun 22, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.72%

Description

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.

Affected products

Vendor n/a Product Quay Default
n/a
- Version
  quay 2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Quay

n/a

Version	Status	Constraints
quay 2	affected	-

Product	Package	State	Advisory
Red Hat Quay 2	quay	Will not fix	n/a
Red Hat Quay 3	quay	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://access.redhat.com/security/cve/CVE-2019-3865
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1768297
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3865
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13479
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3865
https://www.cve.org/CVERecord?id=CVE-2019-3865

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-3865		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1768297		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3865		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13479		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3865
https://www.cve.org/CVERecord?id=CVE-2019-3865