CVE-2019-16919

Harbor API has a Broken Access Control vulnerability

published October 18, 2019

CVSS
—
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01711 · 77.2th percentile
Published
2019-10-18T11:59Z
EPSS history
Timeline
  • 18 OCT 11:59Z
    Harbor API has a Broken Access Control vulnerability
    cvelistv5