CVE-2020-27831
published 2021-05-27CVE-2020-27831: A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.55%
42.0th percentile
A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | quay | — | — |
| redhat | quay | >= 3.0.0 < 3.3.3 | 3.3.3 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
quay: email notifications authorization bypass
vendor_redhat·2020-12-09·CVSS 4.3
CVE-2020-27831 [MEDIUM] CWE-284 quay: email notifications authorization bypass
quay: email notifications authorization bypass
A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
Mitigation: Disable email using the configuration app.
GHSA
GHSA-3mxm-3qx9-6gq2: A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email not
ghsa_unreviewed·2022-05-24
CVE-2020-27831 [MEDIUM] CWE-284 GHSA-3mxm-3qx9-6gq2: A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email not
A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-05-27
Published