PT-2019-4005 · Vmware · Harbor

Michmike · Publicado 2019-10-15 · Atualizado 2020-04-01 · CVE-2019-16919

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Harbor (affected versions not specified)

Description The issue is related to a Broken Access Control vulnerability in the Harbor API. This vulnerability allows project administrators to create a robot account with unauthorized push and/or pull access permissions to a project they do not have access or control over. The Harbor API fails to enforce proper project permissions and project scope on API requests to create new robot accounts. The vulnerability can be exploited by a remote attacker to elevate their privileges and gain unauthorized access to adjacent projects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

BDU:2019-04536

CVE-2019-16919

GHSA-X2R2-W9C7-H624

Produtos afetados

Harbor

Referências · 10

• https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624 · Correção
• https://github.com/goharbor/harbor/releases/tag/v1.9.1 · Nota
• https://github.com/goharbor/harbor/releases/tag/v1.8.4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16919 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2019-0016.html · Nota
• https://bdu.fstec.ru/vul/2019-04536 · Nota de Segurança
• https://landscape.cncf.io/selected=harbor · Nota
• https://osv.dev/vulnerability/CVE-2019-16919 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16919 · Nota
• https://vmware.com/security/advisories/VMSA-2019-0016.html · Nota