CVE-2022-31671CWE-285
Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
High · published November 14, 2024
What it is
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.
The record
Technical detail
- CVSS v3.1
- 7.4 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00530 · 44.0th percentile
- Weakness
- CWE-285 · Improper Authorization
- Published
- 2024-11-14T11:42Z
EPSS history
Timeline