What is CVE-2019-10205?

CVE-2019-10205 is a medium-severity vulnerability in Red Hat Quay, classified under Insufficiently Protected Credentials. CVSS score: 6.3/10. Published 2020-01-02.

How severe is CVE-2019-10205?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Red Hat Quay

CVE-2019-10205

A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.

EPSS: 0.003 (19.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H.

Affected products

Red Hat Quay — versions n/a
Redhat Quay — versions 3.0.0

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10205?: CVE-2019-10205 is a medium-severity vulnerability in Red Hat Quay, classified under Insufficiently Protected Credentials. CVSS score: 6.3/10. Published 2020-01-02.
How severe is CVE-2019-10205?: Medium severity. CVSS v3 base score is 6.3 out of 10.