Every CVE Search/ Get API key

CVE-2022-31668

User permission validation failure and disclosure of P2P preheat execution logs

7.4 HighFix available

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.30%Up 0.3 points since Nov 15, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.4

User permission validation failure and disclosure of P2P preheat execution logs

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
CVE-2022-31668
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
EUVDEUVD-2024-3308 7.4

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
EUVD-2024-3308
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-r864-28pw-8682 7.4

Harbor fails to validate the user permissions when updating p2p preheat policies

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
GHSA-r864-28pw-8682
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
NVD 7.4

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
CVE-2022-31668
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-285, CWE-863
Updated
2026-11-02
OSV 7.4

User permission validation failure and disclosure of P2P preheat execution logs

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
CVE-2022-31668
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
OSVGHSA-r864-28pw-8682 7.4

Harbor fails to validate the user permissions when updating p2p preheat policies

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
GHSA-r864-28pw-8682
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-285
Updated
2026-11-02
OSVBIT-harbor-2022-31668 No score

User permission validation failure and disclosure of P2P preheat execution logs

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
BIT-harbor-2022-31668
Updated
2026-11-02
OSVGO-2024-3268 No score

Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

Record
GO-2024-3268
Updated
2026-11-02
OSVopenSUSE-SU-2024:14599-1 No score

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14599-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/goharbor/harbor
Go
 2.0.0 up to 2.4.3
2.4.3
github.com/goharbor/harbor
Go
 2.5.0 up to 2.5.2
2.5.2
github.com/goharbor/harbor/src
Go
 before 0.0.0-20220630175814-b4ef1db
0.0.0-20220630175814-b4ef1db
harbor
Bitnami
 2.0.0 up to 2.4.3, 2.5.0 up to 2.5.2
2.4.32.5.2
github.com/goharbor/harbor
Go
 2.0.0+incompatible up to 2.4.3+incompatible, 2.5.0+incompatible up to 2.5.2+incompatible
2.4.3+incompatible2.5.2+incompatible
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 0.0.20241213T205935-1.1
0.0.20241213T205935-1.1

History

History
RecordedChangedSources
affected, facts
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31668 is a high vulnerability (CVSS 7.4) in Harbor, published November 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in github.com/goharbor/harbor 2.4.3.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open