TI-2022-13590 Aliases CVE-2022-31671 GHSA-q76q-q8hw-hmpw

Improper authorization in Harbor

LOW 33CWE-285Published 2024-11-14 · Updated 2024-11-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0053 45th percentileScored 2026-11-07

Fix Fixed github.com/goharbor/harbor (Go): 1.10.13, 2.4.3, 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Harbor	Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1	—	No fix listed	CNA
—	github.com/goharbor/harbor (Go)	1.0.0 to before 1.10.13	1.10.13	Patch available	GHSA-q76q-q8hw-hmpw
—	github.com/goharbor/harbor (Go)	2.0.0 to before 2.4.3	2.4.3	Patch available	GHSA-q76q-q8hw-hmpw
—	github.com/goharbor/harbor (Go)	2.5.0 to before 2.5.2	2.5.2	Patch available	GHSA-q76q-q8hw-hmpw

Harbor Vendor— Affected Harbor (Go) 2.x<=2.4.2; 2.5<=2.5.1 Fixed in — No fix listed CNA
github.com/goharbor/harbor (Go) Vendor— Affected 1.0.0 to before 1.10.13 Fixed in 1.10.13 Patch available GHSA-q76q-q8hw-hmpw
github.com/goharbor/harbor (Go) Vendor— Affected 2.0.0 to before 2.4.3 Fixed in 2.4.3 Patch available GHSA-q76q-q8hw-hmpw
github.com/goharbor/harbor (Go) Vendor— Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-q76q-q8hw-hmpw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:harbor::::::::	2.0.0 to before 2.4.3; 2.5.0 to before 2.5.2	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.4.3; 2.5.0 to before 2.5.2 Vulnerable ·backstage

Remediation

Fix · GHSA-q76q-q8hw-hmpw github.com/goharbor/harbor (Go) Fixed in 1.10.13 Advisory →
Fix · GHSA-q76q-q8hw-hmpw github.com/goharbor/harbor (Go) Fixed in 2.4.3 Advisory →
Fix · GHSA-q76q-q8hw-hmpw github.com/goharbor/harbor (Go) Fixed in 2.5.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31671
2026-10-03 Alias added: GHSA-q76q-q8hw-hmpw

References

Advisory 3

Other 1

https://github.com/goharbor/harbor

TI-2019-13717 Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows… CVSS 3.1MEDIUM 5.3
TI-2019-12090 core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin… CVSS 3.1MEDIUM 6.5
TI-2022-22962 An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and… CVSS 3.1HIGH 7.5
TI-2026-03829 Hard-coded credentials in backstage Harbor CVSS 3.1CRITICAL 9.4
TI-2019-13713 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege… CVSS 3.1HIGH 8.8
TI-2019-13714 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the… CVSS 3.1HIGH 8.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences