CVE-2022-31671: Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
First published: Fri Sep 09 2022(Updated: )
### Impact Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs - API call GET /projects/{project_name}/preheat/policies/{preheat_policy_name}/executions/{execution_id}/tasks/{task_id}/logs By sending a request that attempts to read P2P preheat execution logs and specifying different job ids, malicious authenticatedusers could read all the job logs stored in the Harbor database. ### Patches This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible. ### Workarounds There are no workarounds available. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor) ### Credits Thanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.
Credit: security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/goharbor/harbor | >=2.5.0<=2.5.1 | 2.5.2 |
| go/github.com/goharbor/harbor | >=2.0.0<=2.4.2 | 2.4.3 |
| go/github.com/goharbor/harbor | >=1.0.0<=1.10.12 | 1.10.13 |
| Harbor | >=2.0.0<2.4.3 | |
| Harbor | >=2.5.0<2.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-31671?
CVE-2022-31671 is a medium severity vulnerability due to improper user permission validation.
How do I fix CVE-2022-31671?
To mitigate CVE-2022-31671, upgrade to Harbor version 2.5.2 or 2.4.3, or 1.10.13.
Which versions of Harbor are affected by CVE-2022-31671?
CVE-2022-31671 affects Harbor versions from 2.5.0 to 2.5.1, 2.0.0 to 2.4.2, and 1.0.0 to 1.10.12.
What type of vulnerability is CVE-2022-31671?
CVE-2022-31671 is an authorization issue associated with the API call for reading job execution logs.
What impact does CVE-2022-31671 pose to users?
CVE-2022-31671 may allow unauthorized users to access sensitive job execution logs.
- agent/first-publish-date
- agent/title
- agent/type
- agent/description
- agent/severity
- agent/event
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- agent/weakness
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-q76q-q8hw-hmpw
- alias/CVE-2022-31671
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/go
- vendor/linuxfoundation
- canonical/harbor
- version/harbor/2.0.0
- version/harbor/2.5.0