CVE-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
linuxfoundationharbor
𝑥
< 2.0.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/goharbor/harbor/releases
https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788
https://www.youtube.com/watch?v=v8Isqy4yR3Q
https://github.com/goharbor/harbor/releases
https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788
https://www.youtube.com/watch?v=v8Isqy4yR3Q