CVE-2022-31668

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::

History

19 Nov 2024, 15:25

Type	Values Removed	Values Added
References	~~() https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7 - Third Party Advisory~~	() https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7 - Vendor Advisory

19 Nov 2024, 15:15

Type	Values Removed	Values Added
CPE		cpe:2.3:a:linuxfoundation:harbor::::::::
CWE		CWE-863
First Time		Linuxfoundation harbor Linuxfoundation
CVSS	v2 : ~~unknown~~ v3 : ~~7.4~~	v2 : unknown v3 : 7.7
References	~~() https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7 -~~	() https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7 - Third Party Advisory

15 Nov 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) Harbor no puede validar los permisos de usuario al actualizar las políticas de precalentamiento P2P. Al enviar una solicitud para actualizar una política de precalentamiento P2P con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podría modificar las políticas de precalentamiento P2P configuradas en otros proyectos.

14 Nov 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-14 12:15

Updated : 2024-11-19 15:25

NVD link : CVE-2022-31668

Mitre link : CVE-2022-31668

CVE.ORG link : CVE-2022-31668

JSON object : View

Products Affected

linuxfoundation

harbor

CWE

CWE-863

Incorrect Authorization

CWE-285

Improper Authorization

{"id": "CVE-2022-31668", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "published": "2024-11-14T12:15:16.607", "references": [{"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Harbor fails to validate the user permissions when updating p2p preheat policies.\u00a0By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects."}, {"lang": "es", "value": "Harbor no puede validar los permisos de usuario al actualizar las pol\u00edticas de precalentamiento P2P. Al enviar una solicitud para actualizar una pol\u00edtica de precalentamiento P2P con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podr\u00eda modificar las pol\u00edticas de precalentamiento P2P configuradas en otros proyectos."}], "lastModified": "2024-11-19T15:25:25.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14BEA987-A012-4745-A79A-7BCF5E9CD567", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B643770-6018-4D81-B386-91011E437F0D", "versionEndExcluding": "2.5.2", "versionStartIncluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}