SQL-Injection in Harbor allows priviledge users to leak the task IDs
Weakness
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Harbor | Linuxfoundation | 2.8.1 (including) | 2.8.6 (excluding) |
| Harbor | Linuxfoundation | 2.9.0 (including) | 2.9.4 (excluding) |
| Harbor | Linuxfoundation | 2.10.0 (including) | 2.10.2 (excluding) |
Extended Description
When a user can set a primary key to any value, then the user can modify the key to point to unauthorized records. Database access control errors occur when: