{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-16T06:03:28.430","vulnerabilities":[{"cve":{"id":"CVE-2022-31668","sourceIdentifier":"security@vmware.com","published":"2024-11-14T12:15:16.607","lastModified":"2024-11-19T15:25:25.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects."},{"lang":"es","value":"Harbor no puede validar los permisos de usuario al actualizar las políticas de precalentamiento P2P. Al enviar una solicitud para actualizar una política de precalentamiento P2P con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podría modificar las políticas de precalentamiento P2P configuradas en otros proyectos."}],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":3.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}]},"weaknesses":[{"source":"security@vmware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.4.3","matchCriteriaId":"14BEA987-A012-4745-A79A-7BCF5E9CD567"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndExcluding":"2.5.2","matchCriteriaId":"1B643770-6018-4D81-B386-91011E437F0D"}]}]}],"references":[{"url":"https://github.com/goharbor/harbor/security/advisories/GHSA-3wpx-625q-22j7","source":"security@vmware.com","tags":["Vendor Advisory"]}]}}]}