Vulnerability details
CVE-2022-31671
Harbor
Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
CVSS 3.1
7.4High
Official description
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.4High | 3.1 | CVEProject cvelistV5 (CNA) (vmware) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | Harbor | Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-11-14
- Last updated
- 2024-11-14
- State
- Published
- Assigner (CNA)
- vmware
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-285