PT-2019-4005 · Vmware · Harbor

Michmike · Published 2019-10-15 · Updated 2020-04-01 · CVE-2019-16919

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Harbor (affected versions not specified)

Description The issue is related to a Broken Access Control vulnerability in the Harbor API. This vulnerability allows project administrators to create a robot account with unauthorized push and/or pull access permissions to a project they do not have access or control over. The Harbor API fails to enforce proper project permissions and project scope on API requests to create new robot accounts. The vulnerability can be exploited by a remote attacker to elevate their privileges and gain unauthorized access to adjacent projects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2019-04536

CVE-2019-16919

GHSA-X2R2-W9C7-H624

Affected Products

Harbor

References · 10

• https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-16919 · Security Note
• https://bdu.fstec.ru/vul/2019-04536 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16919 · Vendor Advisory
• https://github.com/goharbor/harbor/releases/tag/v1.9.1 · Note
• https://github.com/goharbor/harbor/releases/tag/v1.8.4 · Note
• http://vmware.com/security/advisories/VMSA-2019-0016.html · Note
• https://landscape.cncf.io/selected=harbor · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16919 · Note
• https://vmware.com/security/advisories/VMSA-2019-0016.html · Note