// For flags

CVE-2024-3625

Mirror-registry: redis password stored in plain-text

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.

Se encontró una falla en Quay, donde la base de datos de Quay se almacena en texto plano en el registro espejo en el archivo config.yaml de Jinja. Este problema deja la posibilidad de que un actor malicioso con acceso a este archivo obtenga acceso a la instancia de Redis de Quay.

*Credits: Red Hat would like to thank Solomon Roberts (BadgerOps.net works) for reporting this issue.
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-04-10 CVE Reserved
  • 2024-04-25 CVE Published
  • 2024-11-24 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-256: Plaintext Storage of a Password
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Mirror Registry
Search vendor "Redhat" for product "Mirror Registry"
*-
Affected
Redhat
Search vendor "Redhat"
 Openshift
Search vendor "Redhat" for product "Openshift"
*-
Affected