CVE-2023-3384
Quay: stored cross site scripting
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).
| CWE | CWE-79 |
| Vendor | red hat |
| Product | red hat quay 3 |
| Published | Jul 24, 2023 |
| Last Updated | Nov 7, 2025 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat quay 3
Be the first to know when new medium vulnerabilities affecting red hat red hat quay 3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Red Hat / Red Hat Quay 3
All versions affected References
Credits
This issue was discovered by Angel Olle Blazquez (Red Hat).