CVE-2023-3384
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw was found in the Quay registry, which involves a lack of validation for image labels coming from images. While labels created through Quay are validated, labels from images are not subjected to the same validation, allowing an attacker to publish a malicious image.
Risk Assessment
This flaw allows for the execution of a script via Cross-site scripting (XSS), which can lead to serious security breaches within the organization.
Recommendation
It is recommended to implement additional validation for image labels coming from images in the Quay registry to prevent the publication of malicious content.
Original NVD description (English source)
A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).