CVE-2020-13788 Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)

What is CVE-2020-13788?

CVE-2020-13788 is a medium-severity server-side request forgery vulnerability in n/a, published on 15 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.

Weakness: CWE-918

Which versions are affected by CVE-2020-13788?

4 open source packages ship an affected version, including github.com/goharbor/harbor and harbor. It affects 1 product.

Products include Linuxfoundation Harbor.

How do I fix CVE-2020-13788?

Upgrade github.com/goharbor/harbor to a fixed version for your release line: 2.0.1 or 2.0.1+incompatible.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-13788 being exploited?

There is no known exploitation of CVE-2020-13788 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor Critical 9.4
• CVE-2019-19023 Privilege Escalation in Cloud Native Computing Foundation Harbor High 8.8
• CVE-2019-19025 Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor High 8.8
• CVE-2017-17697 Server-side request forgery in n/a High 8.6
• CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-harbor-2020-13788, GHSA-33p6-fx42-7rf5, GO-2022-0781.