CVE-2019-3990 - A User Enumeration flaw exists in Harbor

Back Back to CVE browser

MEDIUM

A User Enumeration flaw exists in Harbor

Published Dec 3, 2019

4.3

MEDIUM

CVSS 3.1

EPSS 1.04%

Description

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Affected products

Vendor n/a Product Harbor Default
n/a
- Version
  Harbor versions 1.9.1 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Harbor

n/a

Version	Status	Constraints
Harbor versions 1.9.1 and prior	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13597
Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg
x_refsource_CONFIRMPatchThird Party Advisory
https://www.tenable.com/security/research/tra-2019-50
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13597		Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg		x_refsource_CONFIRMPatchThird Party Advisory
https://www.tenable.com/security/research/tra-2019-50		x_refsource_MISCThird Party Advisory