HIGH🇵🇱 Wersja polska

CVE-2022-31666

CVSS 7.7v3.1pub. 2024-11-14upd. 2025-02-28

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

  • Linuxfoundation Harbor

    APP
    Linuxfoundation
    2.0.0 – 2.4.3 (excl.)2.5.0 – 2.5.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-4404CRITICAL9.4PL ✓same product

Hardkodowane dane uwierzytelniające w GoHarbor Harbor — nieautoryzowany dostęp do panelu

CVE-2022-31668HIGH7.4same product

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to upda...

CVE-2022-31670HIGH7.7same product

Harbor fails to validate the user permissions when updating tag retention policies.  By sending a request to ...

CVE-2022-31671HIGH7.4same product

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat...

CVE-2022-46463HIGH7.5same product

An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image reposit...