CVE-2022-31671

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31671
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31671.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31671
Aliases
Related
Published
2024-11-14T11:42:22.373Z
Modified
2026-07-15T01:49:14.566204448Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
Details

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1"
                },
                {
                    "last_affected": "Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-285"
    ],
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31671.json"
}
References

Affected packages

Git / github.com/goharbor/harbor

Affected ranges

Type
GIT
Repo
https://github.com/goharbor/harbor
Events
Introduced
d0f3ddddab96f25b7c2de18e7aebf8f79c7b19cc
Fixed
85ef1409cba206582b1b6947c888bdbe6d5747d3
Introduced
98e1b82fbfcc0f1ab9673e0911ae937e6a6fca36
Fixed
66882717920d0337f17a43d5450b6227ca98047e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.4.3"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.5.2"
        }
    ],
    "cpe": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

v2.*
v2.5.0
v2.5.0-rc4
v2.5.1
v2.5.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31671.json"