User Enumeration Vulnerability in Harbor by VMware
CVE-2019-3990

4.3MEDIUM

Key Information:

Vendor
Linux
Status
Harbor
Vendor
CVE Published:
3 December 2019

Summary

A user enumeration vulnerability exists within Harbor, specifically affecting the '/users' API endpoint, which is intended for administrative access only. This restriction can be bypassed, allowing unauthorized users to access sensitive information regarding registered users through the search functionality. As a result, attackers could exploit this flaw to gain insights into user accounts, increasing the risk of further attacks.

Affected Version(s)

Harbor Harbor versions 1.9.1 and prior

References

https://www.tenable.com/security/research/tra-2019-50
x_refsource_MISC
https://github.com/goharbor/harbor/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.