← Volver a CVEs

CVE-2019-3990

MEDIUM

4.3

Descripcion

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Detalles CVE

Puntuacion CVSS v3.14.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado12/3/2019

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

linuxfoundation:harbor

Debilidades (CWE)

CWE-269

Referencias

https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg(vulnreport@tenable.com)

https://www.tenable.com/security/research/tra-2019-50(vulnreport@tenable.com)

https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/research/tra-2019-50(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.