CVE-2024-3622
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.52%
- CWE
- CWE-256
- Published
- 2024-04-25
- Last modified
- 2026-03-13
Weakness type
Related vulnerabilities
- CVE-2025-6561 — Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information
- CVE-2025-6560 — Sapido Wireless Router - Exposure of Sensitive Information
- CVE-2025-5893 — Honding Technology Smart Parking Management System - Exposure of Sensitive Information
- CVE-2025-34210 — Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords
- CVE-2024-6118 — Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password
- CVE-2025-15113 — Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload
- CVE-2025-2500 — A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an
- CVE-2020-5374 — Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain