CVE-2022-31667

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. 

By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-285CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-316687.7Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with aCVE-2022-316697.7Harbor fails to validate the user permissions when updating tag immutability policies.  By sending a request to update a tag immutability pCVE-2022-31678.8Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.CVE-2022-316707.7Harbor fails to validate the user permissions when updating tag retention policies.  By sending a request to update a tag retention policy CVE-2022-316717.4Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a CVE-2022-316727.2VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate CVE-2022-316738.8VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can createCVE-2022-316744.3VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can accessCVE-2022-316757.5VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be abCVE-2022-316767.8VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrativCVE-2022-316775.4An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes cluCVE-2022-316789.1VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allo