CVE-2025-3528: falha de alta gravidade em mirror-registry
Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.2%
A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
mirror-registryRed Hat · MIRROR-REGISTRY-2.0-RHEL-8Red Hat · mirror registry for Red Hat OpenShiftCVEs relacionadas — mirror-registry
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%CVE-2026-32590HIGHMirror-registry: remote code execution using pickle deserializationEPSS 0.5%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2026-2377MEDIUMMirror-registry: quay: quay: server-side request forgery via log export functionalityEPSS 0.4%CVE-2024-3624HIGHMirror-registry: database user and password stored in plain-textEPSS 0.3%CVE-2024-3625HIGHMirror-registry: redis password stored in plain-textEPSS 0.3%