Linuxfoundation: >> Harbor >> 0.4.1 Security Vulnerabilities
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
CVSS Score
6.4
EPSS Score
0.001
Published
2024-08-02
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to
create jobs/stop job tasks and retrieve job task information.
CVSS Score
5.9
EPSS Score
0.003
Published
2023-11-09
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
CVSS Score
5.3
EPSS Score
0.334
Published
2022-12-26
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.
CVSS Score
4.3
EPSS Score
0.007
Published
2020-07-15
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.
CVSS Score
8.6
EPSS Score
0.003
Published
2017-12-15