CVE-2024-3623
Published: 25 April 2024
Summary
CVE-2024-3623 is a medium-severity Plaintext Storage of a Password (CWE-256) vulnerability in Redhat Mirror Registry. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32202
Vulnerability details
A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed…
more
using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay's database.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Protection of passwords and credentials at rest forces encryption or equivalent controls instead of plaintext storage.