Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
Harbor Container Registry Vulnerability: Update Now or Risk Catastrophic Data Exposure!
Unit 42 researchers discovered a broken object-level authorization (BOLA) vulnerability in Harbor versions before 2.9.5, tracked as CVE-2024-22278. This flaw allows users with Maintainer roles to perform unauthorized actions. Organizations should update to the latest Harbor versions to mitigate risks associated with this BOLA vulnerability.
Hot Take:
Looks like Harbor has a new worm on its container! This BOLA vulnerability is no joke, unless you find the idea of rogue Maintainers having a field day with your project settings hilarious. Time to patch up before your containers start spilling secrets like an overstuffed piñata!
Key Points:
- Unit 42 discovered a BOLA vulnerability in Harbor versions before 2.9.5.
- Vulnerability tracked as CVE-2024-22278 with a CVSS score of 6.4.
- Exploited by Maintainers to alter project metadata, bypassing UI restrictions.
- Organizations should update Harbor to versions 2.9.5, 2.10.3, or 2.11.0.
- AI-driven tools were used to find this vulnerability.
Already a member? Log in here