Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Harbor fails to validate the user permissions when updating a robot account
Vulnerability Description
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Vulnerability Type
授权机制不恰当
Vulnerability Title
Harbor 授权问题漏洞
Vulnerability Description
Harbor是Harbor开源的一个开源注册表。通过策略和基于角色的访问控制来保护工件，确保图像被扫描并且没有漏洞，并将图像签名为可信的。 Harbor 2.4.2及之前的2.4.x版本和2.5.1及之前的2.5.X版本存在授权问题漏洞，该漏洞源于在更新机器人账户时未验证用户权限，会导致机器人账户权限被恶意撤销。
CVSS Information
N/A
Vulnerability Type
N/A