VULNERABILITY INTELLIGENCE

CVE-2022-31667

CVSS score6.4 MEDIUM
EPSS probability0.52%
CISA KEVNot currently listed
Published2024-11-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Description

Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.

Weakness classification

  • CWE-285: Improper Authorization
  • CWE-863: Incorrect Authorization

Primary references