CVE-2022-31671

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
n/a	Harbor	Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1

References

https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7Vendor Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-q76q-q8hw-hmpwVendor Advisory

Timeline

Published: Nov 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-316727.2VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate CVE-2022-316738.8VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create CVE-2022-316744.3VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access CVE-2022-316757.5VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be ab CVE-2022-316767.8VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrativ CVE-2022-316775.4An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clu CVE-2022-316789.1VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allo CVE-2022-316793.7Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsup CVE-2022-316809.1The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin CVE-2022-316816.5VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a den CVE-2022-316824.9VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read a CVE-2022-316835.4Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with b