Upstream information

CVE-2022-31668 at MITRE

Description

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
  CNA (VMWare) National Vulnerability Database
Base Score 7.4 7.7
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack Vector Network Network
Attack Complexity Low Low
Privileges Required Low Low
User Interaction None None
Scope Changed Changed
Confidentiality Impact Low None
Integrity Impact Low High
Availability Impact Low None
CVSSv3 Version 3.1 3.1
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20241213T205935-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-14599

SUSE Timeline for this CVE

CVE page created: Thu Nov 14 14:00:42 2024
CVE page last modified: Thu Dec 19 19:47:28 2024