CVE-2025-4374

MEDIUM EPSS 11.3%

Published May 6, 20251y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published May 6, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.

CVSS Details

Base Score

6.5

Exploitability

3.9

Impact

2.5

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

11.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-266

Affected Products 1

Vendor	Product	Version	Range
redhat	quay	*	≤3.14.0

References 2

access.redhat.com https://access.redhat.com/security/cve/CVE-2025-4374

Vendor Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2364267

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.