Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-31671

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Published

2024-11-14T12:15:17.250

Last Modified

2024-11-19T15:40:44.150

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

Weaknesses

Type: Secondary
CWE-285
Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	linuxfoundation	harbor	< 2.4.3	Yes
Application	linuxfoundation	harbor	< 2.5.2	Yes

References

https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7 Vendor Advisory ([email protected])
https://github.com/goharbor/harbor/security/advisories/GHSA-q76q-q8hw-hmpw Vendor Advisory ([email protected])