CVE-2022-31671CWE-285

Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs

High · published November 14, 2024

CVSS v3.1
7.4
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-11-14T11:42Z
EPSS history
Timeline
  • 14 NOV 11:42Z
    Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
    cvelistv5