CVE-2022-31667

Description

Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.

PUBLISHED Reserved 2022-05-25 | Published 2024-11-14 | Updated 2024-11-14 | Assigner vmware

Problem types

CWE-285

References

github.com/...harbor/security/advisories/GHSA-xx9w-464f-7h6f

cve.org (CVE-2022-31667)

nvd.nist.gov (CVE-2022-31667)

Download JSON