CVE-2024-3625

CVE-2024-3625 is a high-severity vulnerability in Quay, where its database credentials are stored in plaintext within the mirror-registry Jinja config.yaml file. This flaw allows an authenticated attacker with local access to this file to gain unauthorized access to Quay's Redis instance, potentially leading to a full compromise of the Quay environment. The vulnerability has a CVSS score of 7.3, indicating a high impact on confidentiality and integrity with low attack complexity and privileges required. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.