-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability manifests in the robot account update endpoint (PUT /robots/{robot_id}). The core failure is an authorization check missing at the project context level when processing updates. While exact code isn't available, the pattern suggests the handler function (likely named UpdateRobot in API controllers) didn't properly verify: 1) ownership of the target robot's project, and 2) user's permissions in that project. This matches the CWE-285/863 descriptions of improper authorization checks. The function would need to retrieve the robot's project context and validate user access - a step that was either missing or implemented incorrectly in vulnerable versions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/goharbor/harbor | go | >= 1.0.0, <= 1.10.12 | 1.10.13 |
| github.com/goharbor/harbor | go | >= 2.0.0, <= 2.4.2 | 2.4.3 |
| github.com/goharbor/harbor | go | >= 2.5.0, <= 2.5.1 | 2.5.2 |
GoGo