Cross-site scripting in [UNKNOWN] quay
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.
Why it matters now
EPSS 0.00736 54th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| [UNKNOWN] | quay | quay 2 | — | No fix listed | CNA |
- quay Vendor[UNKNOWN] Affected quay 2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 2 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3865
- 2026-10-03 Alias added: GHSA-pgwc-cqjm-w595
References
More Red Hat Quay vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
- TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
- TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
- TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
- TI-2019-06946 Some HTTP/2 implementations are vulnerable to window size manipulation and stream… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-3865 · CVE Program
- CVE-2019-3865 · NVD
- FIRST EPSS
- GHSA-pgwc-cqjm-w595 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-3865 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences