Skip to content
OpenAdvisories
Medium · 4.4 CVE-2020-13788 BIT-harbor-2020-13788EUVD-2022-0773GHSA-33p6-fx42-7rf5GO-2022-0781

Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)

Published Jul 15, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: github.com/goharbor/harbor Ecosystem: Go

Description

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/goharbor/harbor >= 1.8.0, < 2.0.1 2.0.1 GHSA-33p6-fx42-7rf5
Go github.com/goharbor/harbor >= 1.8.0, < 2.0.1+incompatible 2.0.1+incompatible GO-2022-0781

References