CVE-2022-46463 Missing authorization in n/a
Attackers can access private image repositories without authentication in Harbor, though the vendor considers this a documented feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46463?
CVE-2022-46463 is a high-severity missing authorization vulnerability in n/a, published on 12 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
Weakness: CWE-306
Which versions are affected by CVE-2022-46463?
1 open source package ship an affected version, including harbor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
harbor Bitnami | From 1.1.0 | 2.5.4 |
Products include Linuxfoundation Harbor.
How do I fix CVE-2022-46463?
Upgrade harbor to 2.5.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-46463 being exploited?
There is no known exploitation of CVE-2022-46463 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor
- CVE-2019-19023 Privilege Escalation in Cloud Native Computing Foundation Harbor
- CVE-2019-19025 Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
- CVE-2017-17697 Server-side request forgery in n/a
- CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
Sources
Also known as BIT-harbor-2022-46463, GHSA-5c53-mg2q-8qhc.