GO-2024-3268
- Source
- https://pkg.go.dev/vuln/GO-2024-3268
- Import Source
- https://vuln.go.dev/ID/GO-2024-3268.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GO-2024-3268
- Aliases
-
- BIT-harbor-2022-31668
- CVE-2022-31668
- GHSA-3wpx-625q-22j7
- GHSA-r864-28pw-8682
- Published
- 2024-12-12T15:46:43Z
- Modified
- 2024-12-12T16:12:01.961253Z
- Summary
- Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor
- Details
-
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2024-3268" }- References
- Credits
-
-
- Gal Goldstein (Oxeye Security)
-
- Daniel Abeles (Oxeye Security)
-
Affected packages
Go / github.com/goharbor/harbor
Package
- Name
- github.com/goharbor/harbor
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/goharbor/harbor