En bref
- CVE-2025-32019 est une vulnérabilité MOYENNE (CVSS 4.1) touchant github.com/goharbor/harbor.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.37%, plus élevée que 30.6% des vulnérabilités.
- Correctif : mettre à jour vers 2.12.4-rc1, 2.12.4-rc1+incompatible, 2.13.1-rc1, 2.13.1-rc1+incompatible ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| github.com/goharbor/harbor Go | ≥ 2.12.0-rc1, < 2.12.4-rc1≥ 2.12.0-rc1+incompatible, < 2.12.4-rc1+incompatible≥ 2.13.0-rc1, < 2.13.1-rc1≥ 2.13.0-rc1+incompatible, < 2.13.1-rc1+incompatible≥ 2.4.0-rc1.1, ≤ 2.11.2< 2.4.0-rc1.0.20250421072404-a13a16383a41all versions
| 2.12.4-rc12.12.4-rc1+incompatible2.13.1-rc12.13.1-rc1+incompatible2.4.0-rc1.0.20250421072404-a13a16383a41
|
Description
Impact
In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.
Patches
Harbor v2.12.3 Harbor 2.11.3
Workarounds
No
References
Credit
[email protected]
NVD description
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
Autres vulnérabilités de github.com/goharbor/harbor
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free