CVE-2022-31666CWE-285

Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies

High · published November 14, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-11-14T11:32Z
EPSS history
Timeline
  • 14 NOV 11:32Z
    Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
    cvelistv5