high7.4
CVE-2022-31668
Harbor fails to validate the user permissions when updating p2p preheat policies
Impact
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/goharbor/harbor | >= 2.0.0, < 2.4.3 | 2.4.3 |
| go | github.com/goharbor/harbor/src | < 0.0.0-20220630175814-b4ef1db | 0.0.0-20220630175814-b4ef1db |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Harbor | from 2.0.0 before 2.4.3 from 2.5.0 before 2.5.2 |