{"schema_version":"1.3.1","id":"GO-2024-3268","modified":"2024-12-12T15:46:43Z","published":"2024-12-12T15:46:43Z","aliases":["CVE-2022-31668","GHSA-r864-28pw-8682"],"summary":"Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor","details":"Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.","affected":[{"package":{"name":"github.com/goharbor/harbor","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0+incompatible"},{"fixed":"2.4.3+incompatible"},{"introduced":"2.5.0+incompatible"},{"fixed":"2.5.2+incompatible"}]}],"ecosystem_specific":{}}],"references":[{"type":"ADVISORY","url":"https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7"}],"credits":[{"name":"Gal Goldstein (Oxeye Security)"},{"name":"Daniel Abeles (Oxeye Security)"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-3268","review_status":"REVIEWED"}}