https://github.com/goharbor/harbor/security/advisories/GHSA-fqvr-xx6w-m6m7

CVE-2019-16097

Impact
The internal testing team of Harbor has identified a critical vulnerability. The vulnerability allows attackers to take over Harbor registries by sending them a malicious request. The vulnerability was immediately fixed by the Harbor team and backported to all supported versions
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API.
How to tell if your product is affected:

You use database authentication.
AND
You have self-registration enabled.

Patches
If your product uses Harbor, updates to 1.7.6/1.8.3 should be taken immediately.
Affected Harbor versions are:

1.7.x prior to 1.7.6 (fixed in 1.7.6)
1.8.x prior to 1.8.3 (fixed in 1.8.3)

Workarounds
There are no workarounds outside of upgrading
References

https://nvd.nist.gov/vuln/detail/CVE-2019-16097
https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/

For more information
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io

View our security policy at https://github.com/goharbor/harbor/security/policy
Open a ticket as per https://github.com/goharbor/harbor/issues/new/choose
Email us at cncf-harbor-security@lists.cncf.io

暂无

CVE-2019-16097

暂无

暂无