5.5
CVE-2024-22261
- EPSS 0.27%
- Published 11.06.2024 00:15:13
- Last modified 26.02.2025 20:23:31
- Source security@vmware.com
- Teams watchlist Login
- Open Login
SQL-Injection in Harbor allows priviledge users to leak the task IDs
Data is provided by the National Vulnerability Database (NVD)
Linuxfoundation ≫ Harbor Version >= 2.8.1 < 2.8.6
Linuxfoundation ≫ Harbor Version >= 2.9.0 < 2.9.4
Linuxfoundation ≫ Harbor Version >= 2.10.0 < 2.10.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.27% | 0.503 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.2 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
|
| security@vmware.com | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
|
CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.