Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.
References
Link | Resource |
---|---|
http://www.vmware.com/security/advisories/VMSA-2019-0016.html | Third Party Advisory |
https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624 | Patch Third Party Advisory |
https://landscape.cncf.io/selected=harbor | Product Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-10-18T11:59:57
Updated: 2019-10-18T12:00:13
Reserved: 2019-09-26T00:00:00
Link: CVE-2019-16919
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-10-18T12:15:10.190
Modified: 2020-04-01T15:05:02.570
Link: CVE-2019-16919
JSON object: View
Redhat Information
No data.
CWE