« Volver al listado

CVE-2019-3990

Estado: ModificadaMedia (4.3)—

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linuxfoundation — Harbor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-3990",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Harbor",
          "versions": [
            {
              "status": "affected",
              "version": "Harbor versions 1.9.1 and prior"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-03T17:15:11.727",
  "references": [
    {
      "url": "https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2019-50",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2019-50",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A User Enumeration flaw exists in Harbor. The issue is present in the \"/users\" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the \"search\" functionality."
    },
    {
      "lang": "es",
      "value": "Se presenta un fallo de Enumeración de Usuarios en Harbor. El problema está presente en el endpoint de la API \"/users\". Se supone que este endpoint está restringido a los administradores. Esta restricción puede ser omitida y la información puede ser obtenida acerca de los usuarios registrados por medio de la funcionalidad \"search\"."
    }
  ],
  "lastModified": "2026-06-17T02:36:00.433",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F134317F-4296-42B6-8915-32810C62EA1E",
              "versionEndIncluding": "1.7.6",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "026081A9-A57C-44AA-95CC-2E0A984748DF",
              "versionEndIncluding": "1.8.5",
              "versionStartIncluding": "1.8.0"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:1.9.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AD98173-4AAE-485F-BA41-F0E575EFD6E8"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB9B2E26-AD5F-4B79-A3E1-46355602B4ED"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C01B4A7-A85B-4057-9923-6AD82CE37C10"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:1.9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4003793B-3CA7-462C-9B33-8898D4A6CFD4"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:harbor:1.9.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8711FA8-827F-4887-BB20-53A4B0E6E9C9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com"
}