CVE-2024-3625: high-severity vulnerability in mirror-registry
Mirror-registry: redis password stored in plain-text
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.3%
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Related CVEs — mirror-registry
In the same product, most dangerous first.
CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%CVE-2026-32590HIGHMirror-registry: remote code execution using pickle deserializationEPSS 0.5%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2026-2377MEDIUMMirror-registry: quay: quay: server-side request forgery via log export functionalityEPSS 0.4%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2026-32591MEDIUMMirror-registry: quay: server-side request forgery in proxy cache upstream registry configurationEPSS 0.3%