CVE-2022-31670: Harbor fails to validate the user permissions when updating tag retention policies
First published: Fri Sep 16 2022(Updated: )
### Impact Harbor fails to validate the user permissions when updating tag retention policies. API call: PUT /retentions/{id} By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured in other projects. ### Patches This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible. ### Workarounds There are no workarounds available. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor) ### Credits Thanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.
Credit: security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/goharbor/harbor | >=2.5.0<=2.5.1 | 2.5.2 |
| go/github.com/goharbor/harbor | >=2.0.0<=2.4.2 | 2.4.3 |
| go/github.com/goharbor/harbor | >=1.0.0<=1.10.12 | 1.10.13 |
| Harbor | >=1.0.0<1.10.13 | |
| Harbor | >=2.0.0<2.4.3 | |
| Harbor | >=2.5.0<2.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-31670?
CVE-2022-31670 has been classified with a moderate severity due to improper validation of user permissions.
How do I fix CVE-2022-31670?
To remediate CVE-2022-31670, update Harbor to version 2.5.2, 2.4.3, or 1.10.13 or later.
What versions are affected by CVE-2022-31670?
CVE-2022-31670 affects Harbor versions from 2.0.0 to 2.5.1, and 1.0.0 to 1.10.12.
Can CVE-2022-31670 lead to unauthorized access?
Yes, CVE-2022-31670 can lead to unauthorized access as it allows users to update tag retention policies without proper permission checks.
What components of Harbor are impacted by CVE-2022-31670?
CVE-2022-31670 impacts the API endpoint for updating tag retention policies in Harbor.
- agent/title
- agent/type
- agent/severity
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- agent/weakness
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3637-v6vq-xqqw
- alias/CVE-2022-31670
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/go
- vendor/linuxfoundation
- canonical/harbor
- version/harbor/1.0.0
- version/harbor/2.0.0
- version/harbor/2.5.0