CVE-2022-31669

Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::

History

19 Nov 2024, 15:20

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.4~~	v2 : unknown v3 : 7.7
CPE		cpe:2.3:a:linuxfoundation:harbor::::::::
References	~~() https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6 -~~	() https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6 - Vendor Advisory
First Time		Linuxfoundation harbor Linuxfoundation
CWE		CWE-863

15 Nov 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) Harbor no puede validar los permisos de usuario al actualizar las políticas de inmutabilidad de etiquetas. Al enviar una solicitud para actualizar una política de inmutabilidad de etiquetas con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podría modificar las políticas de inmutabilidad de etiquetas configuradas en otros proyectos.

14 Nov 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-14 12:15

Updated : 2024-11-19 15:20

NVD link : CVE-2022-31669

Mitre link : CVE-2022-31669

CVE.ORG link : CVE-2022-31669

JSON object : View

Products Affected

linuxfoundation

harbor

CWE

CWE-863

Incorrect Authorization

CWE-285

Improper Authorization

{"id": "CVE-2022-31669", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "published": "2024-11-14T12:15:16.817", "references": [{"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Harbor fails to validate the user permissions when updating tag immutability policies.\u00a0\n\nBy sending a request to update a tag immutability policy with an id that belongs to a\nproject that the currently authenticated user doesn\u2019t have access to, the attacker could\nmodify tag immutability policies configured in other projects."}, {"lang": "es", "value": "Harbor no puede validar los permisos de usuario al actualizar las pol\u00edticas de inmutabilidad de etiquetas. Al enviar una solicitud para actualizar una pol\u00edtica de inmutabilidad de etiquetas con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podr\u00eda modificar las pol\u00edticas de inmutabilidad de etiquetas configuradas en otros proyectos."}], "lastModified": "2024-11-19T15:20:01.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14BEA987-A012-4745-A79A-7BCF5E9CD567", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B643770-6018-4D81-B386-91011E437F0D", "versionEndExcluding": "2.5.2", "versionStartIncluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}