{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T03:07:17.409","vulnerabilities":[{"cve":{"id":"CVE-2022-31670","sourceIdentifier":"security@vmware.com","published":"2024-11-14T12:15:17.040","lastModified":"2024-11-19T15:20:54.243","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Harbor fails to validate the user permissions when updating tag retention policies. \n\nBy sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify\ntag retention policies configured in other projects."},{"lang":"es","value":"Harbor no puede validar los permisos de usuario al actualizar las políticas de retención de etiquetas. Al enviar una solicitud para actualizar una política de retención de etiquetas con un ID que pertenece a un proyecto al que el usuario autenticado actualmente no tiene acceso, el atacante podría modificar las políticas de retención de etiquetas configuradas en otros proyectos."}],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}]},"weaknesses":[{"source":"security@vmware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.10.13","matchCriteriaId":"2A003057-D07D-42FC-823E-750DE181D14D"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.4.3","matchCriteriaId":"14BEA987-A012-4745-A79A-7BCF5E9CD567"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndExcluding":"2.5.2","matchCriteriaId":"1B643770-6018-4D81-B386-91011E437F0D"}]}]}],"references":[{"url":"https://github.com/goharbor/harbor/security/advisories/GHSA-3637-v6vq-xqqw","source":"security@vmware.com","tags":["Vendor Advisory"]}]}}]}