CVE-2023-20902

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::
	cpe:2.3:a:linuxfoundation:harbor::::::::

History

No history.

Information

Published : 2023-11-09 01:15

Updated : 2023-11-16 16:43

NVD link : CVE-2023-20902

Mitre link : CVE-2023-20902

CVE.ORG link : CVE-2023-20902

JSON object : View

Products Affected

linuxfoundation

harbor

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2023-20902", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2023-11-09T01:15:07.660", "references": [{"url": "https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf", "tags": ["Exploit", "Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,\u00a0 Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to \ncreate jobs/stop job tasks and retrieve job task information.\n\n\n"}, {"lang": "es", "value": "Una condici\u00f3n de sincronizaci\u00f3n en Harbor 2.6.x y anteriores, Harbor 2.7.2 y anteriores, Harbor 2.8.2 y anteriores y Harbor 1.10.17 y anteriores permite a un atacante con acceso a la red crear trabajos/detener tareas de trabajo y recuperar informaci\u00f3n de tareas de trabajo. ."}], "lastModified": "2023-11-16T16:43:24.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "225BD7C9-8163-410E-80C3-25FA2DB3E17F", "versionEndExcluding": "1.10.17"}, {"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "752DA342-ED60-4E9E-BB1B-B73CE61A95FF", "versionEndIncluding": "2.6.4", "versionStartIncluding": "2.6.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AB5FC66-7E27-4199-9E68-698F222039F9", "versionEndExcluding": "2.7.3", "versionStartIncluding": "2.7.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2D7140D-E5FB-4A2E-85D2-48BF5AB512C5", "versionEndExcluding": "2.8.3", "versionStartIncluding": "2.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}