CVE-2024-22261 SQL Injection in Harbor scan log API

2024-06-1023:25:32

CWE-566

vmware

www.cve.org

harbor

sql injection

exploit

privilege users

task ids

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

Percentile

9.0%

JSON

SQL-Injection in Harbor allows priviledge users to leak the task IDs

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "Harbor",
    "product": "Harbor",
    "repo": "https://github.com/goharbor",
    "vendor": "Harbor",
    "versions": [
      {
        "lessThanOrEqual": "2.8.5",
        "status": "affected",
        "version": "2.8.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.9.3",
        "status": "affected",
        "version": "2.9.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.10.1",
        "status": "affected",
        "version": "2.10.0",
        "versionType": "custom"
      }
    ]
  }
]