Lucene search

RedhatCVE-2019-3867

HistoryMar 18, 2021 - 7:15 p.m.

CVE-2019-3867

2021-03-1819:15:13

CWE-613

redhat

web.nvd.nist.gov

cve-2019-3867

quay

web application

vulnerability

session

expiration

attacker

control

delete

repository

red hat

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

4.1

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

22.8%

JSON

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user’s container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.

Affected configurations

Nvd

Vulners

Node

redhatquayMatch2.0.0

redhatquayMatch3.0.0

VendorProductVersionCPE
redhatquay2.0.0cpe:2.3:a:redhat:quay:2.0.0:*:*:*:*:*:*:*
redhatquay3.0.0cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	quay	2.0.0	cpe:2.3:a:redhat:quay:2.0.0:::::::*
redhat	quay	3.0.0	cpe:2.3:a:redhat:quay:3.0.0:::::::*

CNA Affected

[
  {
    "product": "quay",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "As shipped in Red Hat Quay 2 and 3."
      }
    ]
  }
]

References

bugzilla.redhat.com/show_bug.cgi?id=1772704

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

4.1

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

22.8%

JSON

Related for CVE-2019-3867