CVE-2022-31666

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-285 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-316676.4Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t ha CVE-2022-316687.7Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with a CVE-2022-316697.7Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability p CVE-2022-31678.8Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.CVE-2022-316707.7Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy CVE-2022-316717.4Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a CVE-2022-316727.2VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate CVE-2022-316738.8VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create CVE-2022-316744.3VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access CVE-2022-316757.5VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be ab CVE-2022-316767.8VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrativ CVE-2022-316775.4An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clu