VULNERABILITY INTELLIGENCE

CVE-2022-31666

CVSS score7.7 HIGH
EPSS probability0.50%
CISA KEVNot currently listed
Published2024-11-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Description

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.

Weakness classification

  • security@vmware.com: CWE-285
  • nvd@nist.gov: CWE-862

Primary references