What is CVE-2023-4959?

CVE-2023-4959 is a vulnerability in Quay that allows Cross-Site Request Forgery (CSRF) attacks.

What is the severity of CVE-2023-4959?

CVE-2023-4959 has a severity rating of 6.5, which is considered medium.

How does CVE-2023-4959 work?

CVE-2023-4959 allows an attacker to coerce a user into performing unwanted actions on the Quay instance by exploiting the vulnerability in the config-editor page.

Which version of Quay is affected by CVE-2023-4959?

Quay version 3.0.0 is affected by CVE-2023-4959.

How can I fix the vulnerability CVE-2023-4959?

To fix CVE-2023-4959, it is recommended to update Quay to a version that is not affected, if available. Alternatively, you can apply any patches or security updates provided by the vendor.

Vulnerability/
CVE-2023-4959

medium

6.5

CWE

352 79

14/9/2023

15/9/2023

25/4/2024

CVE-2023-4959: Quay: cross-site request forgery (csrf) on config-editor page

First published: Thu Sep 14 2023(Updated: )

A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).

Credit: secalert@redhat.com secalert@redhat.com

Affected Software	Affected Version	How to fix
Redhat Quay	=3.0.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-4959?
CVE-2023-4959 is a vulnerability in Quay that allows Cross-Site Request Forgery (CSRF) attacks.
What is the severity of CVE-2023-4959?
CVE-2023-4959 has a severity rating of 6.5, which is considered medium.
How does CVE-2023-4959 work?
CVE-2023-4959 allows an attacker to coerce a user into performing unwanted actions on the Quay instance by exploiting the vulnerability in the config-editor page.
Which version of Quay is affected by CVE-2023-4959?
Quay version 3.0.0 is affected by CVE-2023-4959.
How can I fix the vulnerability CVE-2023-4959?
To fix CVE-2023-4959, it is recommended to update Quay to a version that is not affected, if available. Alternatively, you can apply any patches or security updates provided by the vendor.

collector/nvd-api
collector/nvd-index
agent/author
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/weakness
agent/references
agent/severity
agent/title
agent/description
agent/event
agent/tags
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2023-4959
vendor/redhat
canonical/redhat quay
version/redhat quay/3.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.