CVE-2019-16919: High severity harbor vulnerability
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16919?
The severity of CVE-2019-16919 is high.
What is the description of CVE-2019-16919?
CVE-2019-16919 is a Broken Access Control vulnerability in Harbor API that allows project administrators to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for.
How does CVE-2019-16919 affect Harbor API?
CVE-2019-16919 affects Harbor API by not enforcing the proper access controls, allowing project administrators to create unauthorized robot accounts with access permissions to projects they shouldn't have.
What software versions are affected by CVE-2019-16919?
Harbor versions 1.8.0 to 1.8.3, 1.9.0, VMware Cloud Foundation, and Vmware Harbor Container Registry versions 1.7.0 to 1.7.6 and 1.8.0 to 1.8.4 are affected by CVE-2019-16919.
How can I fix CVE-2019-16919?
To fix CVE-2019-16919, update Harbor API to a version that has a fix for this vulnerability.