| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/goharbor/harbor | ≥ 1.0.0, < 1.10.13≥ 2.0.0, < 2.4.3≥ 2.5.0, < 2.5.2 | 1.10.132.4.32.5.2 |
| harbor | ≥ 2.0.0, < 2.4.3≥ 2.5.0, < 2.5.2 | 2.4.32.5.2 |
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call:
PUT /robots/{robot_id}
By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.
There are no workarounds available.
If you have any questions or comments about this advisory:
Thanks to Gal Goldstein and Daniel Abeles from Oxeye Security for reporting this issue.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン