What is CVE-2023-4956?

CVE-2023-4956 is a vulnerability found in Quay that allows clickjacking on the config-editor page.

What is the severity of CVE-2023-4956?

The severity of CVE-2023-4956 is medium with a CVSS score of 6.5.

How does CVE-2023-4956 affect Redhat Quay?

CVE-2023-4956 affects Redhat Quay version 3.0.0 on the config-editor page.

How can I fix the CVE-2023-4956 vulnerability?

To fix the CVE-2023-4956 vulnerability, it is recommended to update Quay to a version that addresses this issue.

Vulnerability/
CVE-2023-4956

medium

6.5

CWE

1021

14/9/2023

7/11/2023

25/4/2024

CVE-2023-4956: Quay: clickjacking on config-editor page severity

First published: Thu Sep 14 2023(Updated: )

A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
Redhat Quay	=3.0.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-4956?
CVE-2023-4956 is a vulnerability found in Quay that allows clickjacking on the config-editor page.
How does clickjacking work?
Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page.
What is the severity of CVE-2023-4956?
The severity of CVE-2023-4956 is medium with a CVSS score of 6.5.
How does CVE-2023-4956 affect Redhat Quay?
CVE-2023-4956 affects Redhat Quay version 3.0.0 on the config-editor page.
How can I fix the CVE-2023-4956 vulnerability?
To fix the CVE-2023-4956 vulnerability, it is recommended to update Quay to a version that addresses this issue.

collector/nvd-api
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/weakness
agent/references
agent/severity
agent/author
agent/title
agent/description
agent/first-publish-date
agent/event
agent/tags
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2023-4956
vendor/redhat
canonical/redhat quay
version/redhat quay/3.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.