CVE-2022-31668 HIGH

CVE-2022-31668: User permission validation failure and disclosure of P2P preheat execution logs

Vendor N/A

Product Harbor

Weakness CWE-285

Published November 14, 2024

Last update November 14, 2024

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Key dates

02Disclosure timeline

November 14, 2024 CVE published

November 14, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-31668 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/285.html

Related vulnerabilities

04Related CVE

CVE-2026-46668 SpiceDB: Caveat structures with nested lists can result in improper cache reuse CVE-2026-46656 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions CVE-2026-11462 Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization CVE-2026-47342 Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass CVE-2026-12213 hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization