CVE-2019-19026
MEDIUMCVSS 4.9/10EPSS 1.42%
Last modified
CVE-2019-19026 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.. EPSS estimates a 1.42% chance of exploitation in the next 30 days.
Description
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Harbor | >= 1.7.0, < 1.8.6 |
| Linuxfoundation | Harbor | >= 1.9.0, < 1.9.3 |
| Pivotal | Vmware Harbor Registry | All versions |
References
- https://github.com/goharbor/harbor/security/advisoriesThird Party Advisory
- https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64Third Party Advisory
- https://tanzu.vmware.com/security/cve-2019-19026Third Party Advisory
- https://github.com/goharbor/harbor/security/advisoriesThird Party Advisory
- https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64Third Party Advisory
- https://tanzu.vmware.com/security/cve-2019-19026Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-19026?
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
How severe is CVE-2019-19026?
CVE-2019-19026 has a CVSS score of 4.9/10 (MEDIUM severity). The EPSS model estimates a 1.42% probability of exploitation in the next 30 days.
How do I fix CVE-2019-19026?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-19019An issue was discovered in TitanHQ WebTitan before 5.18. It …7.5
- CVE-2019-19020An issue was discovered in TitanHQ WebTitan before 5.18. In …7.2
- CVE-2019-19021An issue was discovered in TitanHQ WebTitan before 5.18. It …9.8
- CVE-2019-19022iTerm2 through 3.3.6 has potentially insufficient documentat…7.5
- CVE-2019-19023Cloud Native Computing Foundation Harbor prior to 1.8.6 and …8.8
- CVE-2019-19025Cloud Native Computing Foundation Harbor prior to 1.8.6 and …8.8
- CVE-2019-19029Cloud Native Computing Foundation Harbor prior to 1.8.6 and …7.2
- CVE-2019-1903A vulnerability in Cisco Security Manager could allow an una…6.5
- CVE-2019-19030Cloud Native Computing Foundation Harbor before 1.10.3 and 2…5.3
- CVE-2019-19031Easy XML Editor through v1.7.8 is affected by: XML External …8.1
- CVE-2019-19032XMLBlueprint through 16.191112 is affected by XML External E…8.1
- CVE-2019-19033Jalios JCMS 10 allows attackers to access any part of the we…9.8
Are you affected by CVE-2019-19026?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST