Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-27831

Date: May 26, 2021

A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.

Language: Python

Severity Score

Related Resources (6)

https://github.com/quay/quay/pull/614
https://access.redhat.com/security/cve/CVE-2020-27831
https://nvd.nist.gov/vuln/detail/CVE-2020-27831
https://bugzilla.redhat.com/show_bug.cgi?id=1905758
https://github.com/quay/quay/commit/6965344ba3a3005039cd26fab58894e7e605c6cc#diff-3217723bc3244f7dcd07b880a7e4c0b5dde03913b743ef72767235a44aa273e7
https://www.mend.io/vulnerability-database/CVE-2020-27831

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Insufficiently Protected Credentials

CWE-522

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us