CVE-2022-31666

Published: Nov 14, 2024Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.

Affected (2)

Products: Linuxfoundation: Harbor

Linuxfoundation

1 product

Harbor

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Harbor	From 2.0.0 to 2.4.3
Linuxfoundation Harbor	From 2.5.0 to 2.5.2

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://github.com/goharbor/harbor/security/advisories/GHSA-8hwq-5f22-jfr3

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.