Skip to main content

Harbor CVE-2024-22261

MEDIUM
Authorization Bypass Through User-Controlled SQL Primary Key (CWE-566)
2024-06-11 security@vmware.com
Information Disclosure Harbor
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 11, 2024 - 00:15 nvd
MEDIUM 5.5

DescriptionNVD

SQL-Injection in Harbor allows priviledge users to leak the task IDs

AnalysisAI

SQL-Injection in Harbor allows priviledge users to leak the task IDs. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-566. SQL-Injection in Harbor allows priviledge users to leak the task IDs Affected products include: Linuxfoundation Harbor.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Harbor

View all
CVE-2017-17697 HIGH POC
8.6 Dec 15

The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/
CVE-2023-20902 MEDIUM POC
6.5 Nov 09

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and bel
CVE-2019-16097 MEDIUM POC
6.5 Sep 08

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A
CVE-2020-13794 MEDIUM POC
4.3 Sep 30

Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. Rated medium severity (
CVE-2020-13788 MEDIUM POC
4.3 Jul 15

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of

CVE-2019-16919 HIGH
7.5 Oct 18

Harbor API has a Broken Access Control vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
CVE-2024-22244 MEDIUM
6.1 Jun 10

Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. Rated medium severity
CVE-2024-22278 MEDIUM
4.3 Aug 02

Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configur
CVE-2019-3990 MEDIUM
4.3 Dec 03

A User Enumeration flaw exists in Harbor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable,

Same weakness CWE-566 – Authorization Bypass Through User-Controlled SQL Primary Key

View all
CVE-2025-9953 CRITICAL
9.8
CVE-2014-0808 CRITICAL
9.1
CVE-2025-56556 LOW POC
3.8
CVE-2025-30368 LOW
2.7
CVE-2025-30369 LOW
2.7

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-22261 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy