CVE Feed

    Dashboard / CVE / CVE-2023-4959

    CVE-2023-4959

    A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).

    Published:Sep 15, 2023
    Last Modified:Nov 7, 2025
    EPS:Sep 15, 2023
    EPSS Score:0.00104
    CVSS Score:6.5

    Affected Products

    Vendor
    Redhat
    Product
    Quay

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-74244 (CVSS 5.9) — A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticate…
    CVE-2026-74243 (CVSS 6.5) — A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unaut…
    CVE-2026-74241 (CVSS 4.8) — A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handli…
    CVE-2026-74242 (CVSS 5.3) — A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notifica…
    CVE-2026-74245 (CVSS 5.9) — A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID cou…
    CVE-2026-74240 (CVSS 5.4) — A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sig…
    CVE-2026-74247 (CVSS 4.2) — A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can ex…
    CVE-2026-19730 (CVSS 4.2) — The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but …
    CVE-2026-19519 (CVSS 4.3) — A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an…
    CVE-2026-18255 (CVSS 7.2) — A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account token…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High