CVE-2022-46463

An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

6.24% chance of exploitation in the next 30 days, 93th percentile

Nuclei

high · CWE-306

Published

2023-01-12

Updated

2025-04-08

Proof-of-concept exploits (2)

• 404tk/CVE-2022-4646358★ · 2024-12-12
• nu0l/CVE-2022-4646331★ · 2025-07-15

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder2/CVE-2022-46463.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-46463.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-22947
• CVE-2022-22965
• CVE-2022-4645
• CVE-2022-46475
• CVE-2022-46443
• CVE-2022-46476