6.4
Moyenne
CVE-2022-31667 Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the…
Description
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Harbor | Versions non publiées |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Harbor
Les 7 CVE de Harbor →
CVE-2022-31668
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p…
7.4
Élevée
CVE-2022-31669
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a…
6.4
Moyenne
CVE-2022-31670
Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a…
7.7
Élevée
CVE-2022-31671
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution…
7.4
Élevée