CVE-2022-31666
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | Harbor | Harbor 2.x<=2.4.2; 2.5<=2.5.1 | affected |
Weaknesses
- CWE-285: CWE-285
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.