CVE-2022-31671 HIGH

CVE-2022-31671: Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs

Vendor N/A
Product Harbor
Weakness CWE-285
Published November 14, 2024
Last update November 14, 2024

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Key dates

02Disclosure timeline

November 14, 2024 CVE published
November 14, 2024 Record updated