BIT-harbor-2022-31667

    Dashboard / Vulnerabilities / BIT-harbor-2022-31667

    BIT-harbor-2022-31667

    Published: 20 Nov 2024Last Modified: 8 Sept 2026

    Summary: Harbor fails to validate the user permissions when updating a robot account

    Details: Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.

    References: https://github.com/goharbor/harbor/security/advisories/GHSA-xx9w-464f-7h6f, https://nvd.nist.gov/vuln/detail/CVE-2022-31667

    Affected packages

    Package

    Name: harbor

    Purl: pkg:bitnami/harbor

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.0.0
    Fixed -2.4.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-harbor-2022-31667 | CVE-DB