Skip to content
OpenAdvisories
Medium · 6.4 CVE-2024-22278 BIT-harbor-2024-22278EUVD-2024-2366GHSA-hw28-333w-qxp3GO-2024-3013

Harbor fails to validate the user permissions when updating project configurations

Published Aug 2, 2024 · Updated Aug 14, 2024 · Assigned by vmware

Vendor: Harbor Product: Harbor Package: github.com/goharbor/harbor Ecosystem: Go

Description

Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.

Affected products

VendorProductAffectedFixed
harbor harbor 2.9.4 – < <v2.9.5, 2.10.2 – < <v2.10.3 <v2.9.5

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/goharbor/harbor < 2.9.5 2.9.5 GHSA-hw28-333w-qxp3
Go github.com/goharbor/harbor >= 2.10.0, < 2.10.3 2.10.3 GHSA-hw28-333w-qxp3
Go github.com/goharbor/harbor < 2.9.5+incompatible · >= 2.10.0+incompatible, < 2.10.3+incompatible 2.9.5+incompatible, 2.10.3+incompatible GO-2024-3013

Advisories 1

References