{"id":"CVE-2023-3384","aliases":["EUVD-2023-44051","GHSA-jgpj-6chm-qj8q"],"status":"published","title":"Quay: stored cross site scripting","description":"A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is\r\nnot performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00488,"percentile":0.42255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-07-24T15:19:20Z","modified":"2026-11-01T05:19:20Z","products":[{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"redhat","product":"quay"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2024:11113","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3384","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216924","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3384"},{"url":"https://github.com/advisories/GHSA-jgpj-6chm-qj8q"}],"sources":{"cve":[{"id":"CVE-2023-3384","title":"Quay: stored cross site scripting","description":"A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is\r\nnot performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).","status":"published","published":"2023-07-24T15:19:20.552Z","modified":"2026-11-01T05:19:20.5Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-44051","description":"A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is\r\nnot performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).","status":"published","published":"2023-07-24T15:19:20Z","modified":"2026-11-01T05:19:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:58:49.629727Z"}],"ghsa":[{"id":"GHSA-jgpj-6chm-qj8q","title":"A flaw was found in the Quay registry. While the image labels created through Quay undergo...","description":"A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is\nnot performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).","status":"published","published":"2023-07-24T18:30:44Z","modified":"2026-08-06T12:31:13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:09.171432Z"}],"nvd":[{"id":"CVE-2023-3384","description":"A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is\r\nnot performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).","status":"published","published":"2023-07-24T16:15:12.523Z","modified":"2026-08-06T11:16:27.59Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:18.687088Z"}]}}