Server side request forgery (ssrf)

2017-12-1509:29:00

PRIOn knowledge base

www.prio-n.com

8.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.4%

The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.

CPENameOperatorVersion
harborlt1.3.0
harboreq1.3.0
harboreq1.3.0 rc1
harboreq1.3.0 rc2
harboreq1.3.0 rc3
harboreq1.3.0 rc4

Name	Operator	Version
harbor	lt	1.3.0
harbor	eq	1.3.0
harbor	eq	1.3.0 rc1
harbor	eq	1.3.0 rc2
harbor	eq	1.3.0 rc3
harbor	eq	1.3.0 rc4

References

github.com/vmware/harbor/issues/3755