CVE-2019-16097

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-16097
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16097.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-16097
Aliases
Published
2019-09-08T16:15:11.820Z
Modified
2026-04-10T04:15:50.749337Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.

References

Affected packages

Git / github.com/goharbor/harbor

Affected ranges

Type
GIT
Repo
https://github.com/goharbor/harbor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8017a20e0c04a66367d71d6a9ea80c8430ee51ef
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bcd6947fcc76ede0893c9885b1945ead7bfc6866
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3b3311b4f3aa78d75af3a7f230d5a53ec47d775a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c380652540cb8061cff50f0ce2115fc6d217019b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
98ab7f5644d691c34824d790697a8c240f3aaf8d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
46882f220d49b7492fb37f69fc7f996a3dc57864
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ce6a623748a74f3a779749a355327bb2e80f3ff8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a8f6543ac3a21327745f0990df0e13910fbe579b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9b073a1941df311f30911b59751280e68158550d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
34f02189d72e72ebb5871265b5554d1c0c25bb5e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
25bb24cacbad985246dffbdb883d4bfecaf6aa52
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16b59c41cdbe56fdd6a61e6794621885198edebe
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1c3a3d532f6f315ed2f948631c9e0498e15e715a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ddc119a1547098e978b226420c7b45f5bfd691e8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1c3a3d532f6f315ed2f948631c9e0498e15e715a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3ab5d5f0e55d905f5651ccc6c08ada719c26eb90
Fixed
b6db8a8a106259ec9a2c48be8a380cb3b37cf517
Fixed
afb558e7bcab81e98e56036f1e493cb5a3823a53
Fixed
220e3dee88b561bd4a4a15bc6d0aaa83d63638b0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.0-rc1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.0-rc2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.0-rc1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.0-rc2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.2-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.2-rc1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.2-rc2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.9.0-rc1"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.3.0
0.3.5
0.3.5-rc
0.4.0
0.4.1
0.4.5
0.5.0
0.5.0-rc1
0.5.0-rc2
1.*
1.1.0-rc1
1.1.0-rc2
v1.*
v1.1.0
v1.1.0-rc3
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.2.0-rc4
v1.3.0-rc1
v1.4.0-rc1
v1.4.0-rc2
v1.7.0
v1.7.0-rc1
v1.7.0-rc2
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.8.0
v1.8.0-rc1
v1.8.0-rc2
v1.8.1
v1.8.2
v1.8.2-rc1
v1.8.2-rc2
v1.8.3-rc1
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16097.json"