What is CVE-2019-3990?

CVE-2019-3990 is a medium-severity vulnerability in Linuxfoundation Harbor, classified under Improper Privilege Management. CVSS score: 4.3/10. Published 2019-12-03.

How severe is CVE-2019-3990?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Privilege escalation in Linuxfoundation Harbor

CVE-2019-3990

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Vulnerability class: Privilege Escalation

EPSS: 0.010 (60.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Linuxfoundation Harbor — versions 1.9.0, 1.9.1
N/a Harbor — versions Harbor versions 1.9.1 and prior

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

vulnreport@tenable.com (Third Party Advisory, x_refsource_MISC)
vulnreport@tenable.com (x_refsource_CONFIRM, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2019-3990?: CVE-2019-3990 is a medium-severity vulnerability in Linuxfoundation Harbor, classified under Improper Privilege Management. CVSS score: 4.3/10. Published 2019-12-03.
How severe is CVE-2019-3990?: Medium severity. CVSS v3 base score is 4.3 out of 10.