-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper authorization checks when updating retention policies. The PUT handler (UpdateRetention) would typically be responsible for: 1. Retrieving the policy by ID, 2. Validating user permissions on the associated project. The CWE-285/863 classification and impact description indicate missing project-level permission validation after policy lookup. While exact code isn't available, the API endpoint structure and Harbor's architecture suggest this handler function would be the logical location for the missing authorization check.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/goharbor/harbor | go | >= 1.0.0, <= 1.10.12 | 1.10.13 |
| github.com/goharbor/harbor | go | >= 2.0.0, <= 2.4.2 | 2.4.3 |
| github.com/goharbor/harbor | go | >= 2.5.0, <= 2.5.1 | 2.5.2 |
GoGo