CVE-2024-22278 - Vulnerability Details - OpenCVE

Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linuxfoundation	Harbor

Configuration 1 [-]

OR	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-2366	Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
Github GHSA	GHSA-hw28-333w-qxp3	Harbor fails to validate the user permissions when updating project configurations

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/goharbor/harbor/security/advisories/GHSA-hw28-333w-qxp3

History

Wed, 14 Aug 2024 21:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`	cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L'}`

Fri, 09 Aug 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linuxfoundation Linuxfoundation harbor
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:a:linuxfoundation:harbor::::::::
Vendors & Products		Linuxfoundation Linuxfoundation harbor

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-08-02T00:59:55.313Z

Updated: 2024-08-14T21:35:37.751Z

Reserved: 2024-01-08T18:43:18.959Z

Link: CVE-2024-22278

Vulnrichment

Updated: 2024-08-02T16:14:50.056Z

NVD

Status : Modified

Published: 2024-08-02T01:15:23.077

Modified: 2024-08-14T22:15:04.253

Link: CVE-2024-22278

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22278", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:18.959Z", "datePublished": "2024-08-02T00:59:55.313Z", "dateUpdated": "2024-08-14T21:35:37.751Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "harbor", "vendor": "harbor", "versions": [{"lessThan": "<v2.9.5", "status": "affected", "version": "2.9.4", "versionType": "custom"}, {"lessThan": "<v2.10.3", "status": "affected", "version": "2.10.2", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations."}], "value": "Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations."}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-08-14T21:35:37.751Z"}, "references": [{"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-hw28-333w-qxp3"}], "source": {"discovery": "UNKNOWN"}, "title": "Harbor fails to validate the user permissions when updating project configurations", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T16:14:46.125656Z", "id": "CVE-2024-22278", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T16:15:02.950Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T16:14:46.125656Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T16:14:50.056Z"}}], "cna": {"title": "Harbor fails to validate the user permissions when updating project configurations", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "harbor", "product": "harbor", "versions": [{"status": "affected", "version": "2.9.4", "lessThan": "<v2.9.5", "versionType": "custom"}, {"status": "affected", "version": "2.10.2", "lessThan": "<v2.10.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-hw28-333w-qxp3"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.", "supportingMedia": [{"type": "text/html", "value": "Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-08-14T21:35:37.751Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22278", "state": "PUBLISHED", "dateUpdated": "2024-08-14T21:35:37.751Z", "dateReserved": "2024-01-08T18:43:18.959Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-08-02T00:59:55.313Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}