PT-2020-5956 · Cloud Native Computing Foundation · Harbor

Published 2020-03-19 · Updated 2024-08-21 · CVE-2019-19025

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Native Computing Foundation Harbor versions prior to 1.8.6 and 1.9.3

Description The issue is related to Cross-Site Request Forgery (CSRF) in the Harbor web interface, which does not implement protection mechanisms against such attacks. This allows an attacker to execute any action on the platform in the context of the currently authenticated victim by luring them onto a prepared third-party website. Successful exploitation will lead to third parties executing actions on the platform on behalf of authenticated users and administrators.

Recommendations Update to version 1.8.6 or 1.9.3 to patch this issue immediately. As a temporary workaround, consider restricting access to the Harbor web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2021-02130

CVE-2019-19025

GHSA-GCQM-V682-CCW6

GHSA-RFFR-C932-CPXV

GO-2022-0876

Affected Products

Harbor

References · 12

• https://bdu.fstec.ru/vul/2021-02130 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19025 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19025 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0876 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rffr-c932-cpxv · Vendor Advisory
• https://github.com/goharbor/harbor/security/advisories · Note
• https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6 · Note
• https://t.me/k8security/85 · Telegram Post
• https://tanzu.vmware.com/security/cve-2019-19025 · Note
• https://t.me/cvenotify/14668 · Telegram Post
• https://github.com/advisories/GHSA-rffr-c932-cpxv · Note
• https://t.me/cvenotify/1930 · Telegram Post