CVE-2024-5891
Quay: unauthorized user may authenticate via oauth application token
- State
- Published
- Severity
- 4.2 Medium
- Published
- Jun 12, 2024
- Updated
- Aug 2, 2024
- Reserved
- Jun 12, 2024
Description
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, in configurations where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-1390 Weak Authentication
Affected Products
| Product | Versions |
|---|---|
Red Hat Quay 3Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2024-5891vdb-entry
- RHBZ#2283879issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.