CVE-2019-3990

Published: Dec 3, 2019Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Affected (7)

Products: Linuxfoundation: Harbor

Linuxfoundation

1 product

Harbor

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Harbor	From 1.7.0 to 1.7.6
Linuxfoundation Harbor	From 1.8.0 to 1.8.5
Linuxfoundation Harbor	Version 1.9.0
Linuxfoundation Harbor	Version 1.9.0 rc1
Linuxfoundation Harbor	Version 1.9.0 rc2
Linuxfoundation Harbor	Version 1.9.1
Linuxfoundation Harbor	Version 1.9.1 rc1