CVE-2023-4959: Quay: cross-site request forgery (csrf) on config-editor page

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-15 · updated 2026-11-01
Weakness: CWE-352

Description

A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).

Affected products

Red Hat Quay 3: 3.0.0
Red Hat Quay 3: all versions

References

https://access.redhat.com/security/cve/CVE-2023-4959
https://bugzilla.redhat.com/show_bug.cgi?id=2238908
https://access.redhat.com/security/cve/CVE-2023-4959
https://bugzilla.redhat.com/show_bug.cgi?id=2238908

Get alerted when CVE-2023-4959 or the next vulnerability affects your stack