CVE-2020-27831

MEDIUM

Redhat Quay < 3.3.3 - Improper Access Control

Title source: rule

Description

A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.

References (1)

[Issue Tracking, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1905758

Scores

CVSS v3 4.3

EPSS 0.0013

EPSS Percentile 32.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-284 CWE-522

Status published

Affected Products (1)

redhat/quay < 3.3.3

Timeline

Published May 27, 2021

Tracked Since Feb 18, 2026