CVE-2019-16919
First published: Fri Oct 18 2019(Updated: )
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Harbor | >=1.8.0<=1.8.3 | |
| Linuxfoundation Harbor | =1.9.0 | |
| VMware Cloud Foundation | ||
| Vmware Harbor Container Registry | >=1.7.0<=1.7.6 | |
| Vmware Harbor Container Registry | >=1.8.0<1.8.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-16919?
The severity of CVE-2019-16919 is high.
What is the description of CVE-2019-16919?
CVE-2019-16919 is a Broken Access Control vulnerability in Harbor API that allows project administrators to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for.
How does CVE-2019-16919 affect Harbor API?
CVE-2019-16919 affects Harbor API by not enforcing the proper access controls, allowing project administrators to create unauthorized robot accounts with access permissions to projects they shouldn't have.
What software versions are affected by CVE-2019-16919?
Harbor versions 1.8.0 to 1.8.3, 1.9.0, VMware Cloud Foundation, and Vmware Harbor Container Registry versions 1.7.0 to 1.7.6 and 1.8.0 to 1.8.4 are affected by CVE-2019-16919.
How can I fix CVE-2019-16919?
To fix CVE-2019-16919, update Harbor API to a version that has a fix for this vulnerability.
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/linuxfoundation
- canonical/linuxfoundation harbor
- version/linuxfoundation harbor/1.8.0
- version/linuxfoundation harbor/1.8.3
- version/linuxfoundation harbor/1.9.0
- vendor/vmware
- canonical/vmware cloud foundation
- canonical/vmware harbor container registry
- version/vmware harbor container registry/1.7.0
- version/vmware harbor container registry/1.7.6
- version/vmware harbor container registry/1.8.0