CVE-2022-31669: Harbor fails to validate the user permissions when updating tag immutability policies
First published: Fri Sep 16 2022(Updated: )
### Impact Harbor fails to validate the user permissions when updating tag immutability policies - API call: PUT /projects/{project_name_or_id}/immutabletagrules/{immutable_rule_id} By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects. ### Patches This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible. ### Workarounds There are no workarounds available. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor) ### Credits Thanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.
Credit: security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/goharbor/harbor | >=2.5.0<=2.5.1 | 2.5.2 |
| go/github.com/goharbor/harbor | >=2.0.0<=2.4.2 | 2.4.3 |
| go/github.com/goharbor/harbor | >=1.0.0<=1.10.12 | 1.10.13 |
| Harbor | >=2.0.0<2.4.3 | |
| Harbor | >=2.5.0<2.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the impact of CVE-2022-31669?
CVE-2022-31669 allows unauthorized users to update tag immutability policies due to inadequate permission validation by Harbor.
Which versions of Harbor are affected by CVE-2022-31669?
CVE-2022-31669 affects Harbor versions 2.5.0 to 2.5.1, 2.0.0 to 2.4.2, and 1.0.0 to 1.10.12.
How can I remediate CVE-2022-31669?
To mitigate CVE-2022-31669, upgrade Harbor to version 2.5.2, 2.4.3, or 1.10.13 or later.
What does the CVE-2022-31669 vulnerability allow attackers to do?
Attackers exploiting CVE-2022-31669 can modify tag immutability settings without proper authorization.
Is CVE-2022-31669 an important vulnerability?
Yes, CVE-2022-31669 is important as it can lead to unauthorized changes in tag management within the Harbor container registry.
- agent/title
- agent/type
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- agent/severity
- agent/weakness
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8c6p-v837-77f6
- alias/CVE-2022-31669
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/go
- vendor/linuxfoundation
- canonical/harbor
- version/harbor/2.0.0
- version/harbor/2.5.0