Container Registry Credential Leak

2024-05-2210:46:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

trivy

vulnerability

registry domain validation

credential leakage

aws ecr

google cloud artifact

azure container registry

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Trivy is vulnerable to Container Registry Credential Leak. The vulnerability is due to insufficient registry domain validation which results in container registry credential leakage. An attacker must convince a user intro scanning a malicious container, which then allows an attacker to push/pull containers from AWS ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry.