Lucene search

MitreCVE-2019-16919

HistoryOct 18, 2019 - 12:15 p.m.

CVE-2019-16919

2019-10-1812:15:10

CWE-276

mitre

web.nvd.nist.gov

131

harbor api

access control

vulnerability

nvd

cve-2019-16919

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.6%

JSON

Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don’t have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.

Affected configurations

Nvd

Node

linuxfoundationharborRange1.8.0–1.8.3

linuxfoundationharborMatch1.9.0

Node

vmwarecloud_foundationMatch-

vmwareharbor_container_registryRange1.7.0–1.7.6pivotal_cloud_foundry

vmwareharbor_container_registryRange1.8.0–1.8.4pivotal_cloud_foundry

VendorProductVersionCPE
linuxfoundationharbor*cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*
linuxfoundationharbor1.9.0cpe:2.3:a:linuxfoundation:harbor:1.9.0:*:*:*:*:*:*:*
vmwarecloud_foundation-cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*
vmwareharbor_container_registry*cpe:2.3:a:vmware:harbor_container_registry:*:*:*:*:*:pivotal_cloud_foundry:*:*

Vendor	Product	Version	CPE
linuxfoundation	harbor	*	cpe:2.3:a:linuxfoundation:harbor::::::::
linuxfoundation	harbor	1.9.0	cpe:2.3:a:linuxfoundation:harbor:1.9.0:::::::*
vmware	cloud_foundation	-	cpe:2.3:a:vmware:cloud_foundation:-:::::::*
vmware	harbor_container_registry	*	cpe:2.3:a:vmware:harbor_container_registry::::::pivotal_cloud_foundry::*

References

www.vmware.com/security/advisories/VMSA-2019-0016.html

github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624

landscape.cncf.io/selected=harbor

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.6%

JSON

Related for CVE-2019-16919