Lucene search

GoogleOSV:BIT-HARBOR-2023-20902

HistoryMar 06, 2024 - 10:53 a.m.

BIT-harbor-2023-20902

2024-03-0610:53:13

Google

osv.dev

harbor

software

timing condition

network attacker

job tasks

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.9%

JSON

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

CPENameOperatorVersion
harborlt2.6.4
harborge2.7.0
harborlt1.10.17
harborge2.8.0
harborlt2.7.3
harborlt2.8.3
harborge2.6.0

Name	Operator	Version
harbor	lt	2.6.4
harbor	ge	2.7.0
harbor	lt	1.10.17
harbor	ge	2.8.0
harbor	lt	2.7.3
harbor	lt	2.8.3
harbor	ge	2.6.0

References

github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.9%

JSON

Related for OSV:BIT-HARBOR-2023-20902