CVE-2024-3623

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay's database.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2024-3623	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2274404	Issue Tracking Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-3623	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2274404	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:mirror_registry:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-04-25 18:15

Updated : 2025-07-30 14:34

NVD link : CVE-2024-3623

Mitre link : CVE-2024-3623

CVE.ORG link : CVE-2024-3623

JSON object : View

Products Affected

redhat

mirror_registry

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2024-3623", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-04-25T18:15:09.980", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-3623", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274404", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-3623", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274404", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay's database."}, {"lang": "es", "value": "Se encontr\u00f3 una falla al usar el registro espejo para instalar Quay. Utiliza una clave secreta de base de datos predeterminada, que se almacena en formato de texto plano en uno de los archivos de plantilla de configuraci\u00f3n. Este problema puede provocar que todas las instancias de Quay implementadas mediante el registro espejo tengan la misma clave secreta de la base de datos. Esta falla permite que un actor malintencionado acceda a informaci\u00f3n confidencial de la base de datos de Quay."}], "lastModified": "2025-07-30T14:34:41.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:mirror_registry:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E85DA994-3070-46F3-9828-6A3C23781FC0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}