CVE-2019-3864

published 2020-01-21

CVE-2019-3864: A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as…

high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
red_hat	quay	—	—
redhat	quay	< 3.0.0	3.0.0

CWE-352