-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around missing authorization checks in the p2p preheat policy update flow. Based on: 1) The documented API endpoint PUT /projects/{project_name}/preheat/policies/{preheat_policy_name} 2) Standard Harbor architecture where controllers handle business logic and APIs expose endpoints 3) CWE-285 indicating missing authorization checks 4) The attack vector requiring policy ID manipulation without project access validation. The controller layer would typically handle policy retrieval/modification while the API layer handles request routing. Both layers would need proper authorization checks to prevent this vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/goharbor/harbor | go | >= 2.0.0, < 2.4.3 | 2.4.3 |
| github.com/goharbor/harbor | go | >= 2.5.0, < 2.5.2 | 2.5.2 |
| github.com/goharbor/harbor/src | go | < 0.0.0-20220630175814-b4ef1db | 0.0.0-20220630175814-b4ef1db |
Ongoing coverage of React2Shell