CVE-2022-31668: 
Harbor vulnerability analysis and mitigation

Harbor, a container registry project, contained a vulnerability (CVE-2022-31668) where it failed to validate user permissions when updating p2p preheat policies. The vulnerability was discovered in Harbor versions 2.x<=2.4.2 and 2.5<=2.5.1, and was later addressed in versions 2.4.3+ and 2.5.2+ (GitHub Advisory).

The vulnerability exists in the API endpoint PUT /projects/{project_name}/preheat/policies/{preheat_policy_name}. The issue stems from improper permission validation when updating p2p preheat policies. The vulnerability has been assigned a CVSS v3.1 base score of 7.4 (High severity), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Changed, and Low impact on Confidentiality, Integrity, and Availability (GitHub Advisory).

An attacker could exploit this vulnerability to modify p2p preheat policies configured in other projects that they don't have legitimate access to. This could lead to unauthorized modifications of project configurations and potential security breaches (GitHub Advisory).

The vulnerability has been patched in Harbor versions 2.4.3+ and 2.5.2+. Users are strongly advised to upgrade to these or later versions as soon as possible. No workaround is available for this vulnerability (GitHub Advisory).

The vulnerability was responsibly disclosed by security researchers Gal Goldstein and Daniel Abeles from Oxeye Security (GitHub Advisory).