CVE-2022-31671

🗓️ 14 Nov 2024 11:42:22Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 498 Views🌐 WEB

Reserved candidate for CVE-2022-31671, details will be provided

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-31671	14 Nov 202411:45	–	circl
CNNVD	Harbor authorization issue vulnerability	14 Nov 202400:00	–	cnnvd
Cvelist	CVE-2022-31671 Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs	14 Nov 202411:42	–	cvelist
EUVD	EUVD-2022-6909	3 Oct 202520:07	–	euvd
Github Security Blog	Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs	9 Sep 202219:47	–	github
Mend	CVE-2022-31671	14 Nov 202411:42	–	mend
NVD	CVE-2022-31671	14 Nov 202412:15	–	nvd
osv_bit	BIT-HARBOR-2022-31671 Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs	20 Nov 202407:10	–	osv_bit
osv_cve	CVE-2022-31671 Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs	14 Nov 202411:42	–	osv_cve
osv_ghsa	GHSA-Q76Q-Q8HW-HMPW Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs	9 Sep 202219:47	–	osv_ghsa

NVD

Vulners

Node

linuxfoundation harborRange2.0.0–2.4.3

linuxfoundation harborRange2.5.0–2.5.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Harbor",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7
github	www.github.com/goharbor/harbor/security/advisories/GHSA-q76q-q8hw-hmpw

Parameter	Position	Path	Description	CWE
job_id	path	/api/v1.2/projects/{project_number}/jobs/{job_id}/logs	Insecure Direct Object Reference (IDOR) in Harbor where an authenticated user can read logs of any job by manipulating the job_id in the path, bypassing permission checks.	CWE-285, CWE-863

17 Jun 2026 04:46Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.4

EPSS0.0053

SSVC