CVE-2022-31667 - Harbor Robot Account Privilege Escalation Remote Code Execution

CVE ID : CVE-2022-31667
Published : Nov. 14, 2024, 12:15 p.m. | 24 minutes ago
Description : Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...