CVE-2024-3622
Published: 25 April 2024
Summary
CVE-2024-3622 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Redhat Mirror Registry. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32201
Vulnerability details
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry…
more
to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Protection of passwords and credentials at rest forces encryption or equivalent controls instead of plaintext storage.