Path traversal

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...

CVE-2020-29662

CVE-2020-29662 affects Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2, where the catalog’s registry API is exposed on an unauthenticated path (e.g., GET /v2/_catalog). This can allow information disclosure via an unauthenticated call. Patches are available: upgrade to Harbor v2.0.5 or v2.1.2. If ...