CVEvulnerability

CVE-2019-3990

4.3 MEDIUM Published 2019-12-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-269

Description

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Affected configurations

• linuxfoundation harbor (>= 1.7.0 <= 1.7.6) • linuxfoundation harbor (>= 1.8.0 <= 1.8.5) • linuxfoundation harbor 1.9.0 • linuxfoundation harbor 1.9.1

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References