What is CVE-2022-31666?

CVE-2022-31666 is a high-severity vulnerability in Linuxfoundation Harbor, classified under Improper Authorization. CVSS score: 7.7/10. Published 2024-11-14.

How severe is CVE-2022-31666?

High severity. CVSS v3 base score is 7.7 out of 10.

Is CVE-2022-31666 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Linuxfoundation Harbor

CVE-2022-31666

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects.

EPSS: 0.005 (38.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Linuxfoundation Harbor
N/a Harbor — versions Harbor 2.x<=2.4.2; 2.5<=2.5.1

Weakness classification (CWE)

Public proof-of-concept exploits

akenofu/DevSecOps-Scripts

References

security@vmware.com (Vendor Advisory)

Frequently asked questions

What is CVE-2022-31666?: CVE-2022-31666 is a high-severity vulnerability in Linuxfoundation Harbor, classified under Improper Authorization. CVSS score: 7.7/10. Published 2024-11-14.
How severe is CVE-2022-31666?: High severity. CVSS v3 base score is 7.7 out of 10.
Is CVE-2022-31666 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.