CVSS 3.1
4.9 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVE-2025-30086
Medium (4.9). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/goharbor/harbor 2.12.4, 2.12.4+incompatible, 2.13.1.
CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h27m-3qw8-3pw8 | Go | github.com/goharbor/harbor | >=2.13.0 <2.13.1 | 2.13.1 |
| GHSA-h27m-3qw8-3pw8 | Go | github.com/goharbor/harbor | >=2.4.0-rc1.1 <2.12.4 | 2.12.4 |
| GHSA-h27m-3qw8-3pw8 | Go | github.com/goharbor/harbor | <2.4.0-rc1.0.20250331071157-dce7d9f5cffb | 2.4.0-rc1.0.20250331071157-dce7d9f5cffb |
| GO-2025-3826 | Go | github.com/goharbor/harbor | <2.12.4+incompatible >=2.13.0+incompatible <2.13.1+incompatible | 2.12.4+incompatible, 2.13.1+incompatible |