CVE-2019-3865

2020-06-2217:51:19

CWE-79

redhat

www.cve.org

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

33.8%

JSON

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.

CNA Affected

[
  {
    "product": "quay",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "quay 2"
      }
    ]
  }
]