CVE-2022-31671

Опубликовано: 14 нояб. 2024

Источник: nvd

CVSS3: 7.4

EPSS Низкий

Описание

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Ссылки

https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7
Vendor Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-q76q-q8hw-hmpw
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.4.3 (исключая)

cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*

Версия от 2.5.0 (включая) до 2.5.2 (исключая)

EPSS

Процентиль: 20%

0.00063

Низкий

7.4 High

CVSS3

Дефекты

CWE-285

CWE-863

Связанные уязвимости

GHSA-q76q-q8hw-hmpw

CVSS3: 5

github

почти 3 года назад

Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs