CVEvulnerability

CVE-2019-16097

6.5 MEDIUM Published 2019-09-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
CWE-862

Description

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.

Affected configurations

• linuxfoundation harbor 1.7.0 • linuxfoundation harbor 1.7.1 • linuxfoundation harbor 1.7.2 • linuxfoundation harbor 1.7.3 • linuxfoundation harbor 1.7.4 • linuxfoundation harbor 1.7.5 • linuxfoundation harbor 1.8.0 • linuxfoundation harbor 1.8.1 • linuxfoundation harbor 1.8.2 • linuxfoundation harbor 1.9.0

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References