GHSA-r864-28pw-8682

ghsaUSosv

Harbor fails to validate the user permissions when updating p2p preheat policies

view advisory published 2024-11-14Licence: CC-BY-4.0

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-31668US	high7.7OT elevated	0.30% (23rd)	—	2024-11-14
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the…

references

External citations — patches, advisories, analysis.

https://github.com/goharbor/harborPACKAGE
https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-31668ADVISORY
https://pkg.go.dev/vuln/GO-2024-3268WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan