CVE-2022-31668

Published November 14th, 2024

View on NVD ↗

CVSS v3

7.4

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

goharbor/harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

GitHub

28.7K