CVE-2022-46463

HIGH

Harbor <2.5.3 - Info Disclosure

Title source: llm
STIX 2.1

Description

An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."

Exploits (4)

nomisec WORKING POC 51 stars
by 404tk · poc
https://github.com/404tk/CVE-2022-46463
nomisec WORKING POC 30 stars
by nu0l · poc
https://github.com/nu0l/CVE-2022-46463
nomisec WORKING POC 13 stars
by CodeSecurityTeam · poc
https://github.com/CodeSecurityTeam/harbor
github WORKING POC
by Andyyyyuan · pythonpoc
https://github.com/Andyyyyuan/CVE-Poc/tree/main/CVE-2022-46463-2

Scores

CVSS v3 7.5
EPSS 0.7690
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (1)
linuxfoundation/harbor 1.1.0 - 2.5.3
Published Jan 13, 2023
Tracked Since Feb 18, 2026