Veracode Vulnerability DatabaseVERACODE:47120Container Registry Credential Leak
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Trivy is vulnerable to Container Registry Credential Leak. The vulnerability is due to insufficient registry domain validation which results in container registry credential leakage. An attacker must convince a user intro scanning a malicious container, which then allows an attacker to push/pull containers from AWS ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/aquasecurity/trivy | le | v0.51.1 | |
| github.com/aquasecurity/trivy | le | v0.51.1 |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%