A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2023-4956 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2238886 | Issue Tracking |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2023-11-07T19:12:00.777Z
Updated: 2024-04-25T14:44:40.147Z
Reserved: 2023-09-14T04:52:43.812Z
Link: CVE-2023-4956
JSON object: View
NVD Information
Status : Modified
Published: 2023-11-07T20:15:08.970
Modified: 2023-12-13T08:15:51.330
Link: CVE-2023-4956
JSON object: View
Redhat Information
No data.
CWE