CVE-2019-19030
MEDIUMCVSS 5.3/10EPSS 1.89%
Last modified
CVE-2019-19030 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.. EPSS estimates a 1.89% chance of exploitation in the next 30 days.
Description
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Harbor | < 1.10.3 |
| Linuxfoundation | Harbor | >= 2.0.0, < 2.0.1 |
References
- https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5jExploit, Third Party Advisory
- https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5jExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-19030?
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
How severe is CVE-2019-19030?
CVE-2019-19030 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 1.89% probability of exploitation in the next 30 days.
How do I fix CVE-2019-19030?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-19022iTerm2 through 3.3.6 has potentially insufficient documentat…7.5
- CVE-2019-19023Cloud Native Computing Foundation Harbor prior to 1.8.6 and …8.8
- CVE-2019-19025Cloud Native Computing Foundation Harbor prior to 1.8.6 and …8.8
- CVE-2019-19026Cloud Native Computing Foundation Harbor prior to 1.8.6 and …4.9
- CVE-2019-19029Cloud Native Computing Foundation Harbor prior to 1.8.6 and …7.2
- CVE-2019-1903A vulnerability in Cisco Security Manager could allow an una…6.5
- CVE-2019-19031Easy XML Editor through v1.7.8 is affected by: XML External …8.1
- CVE-2019-19032XMLBlueprint through 16.191112 is affected by XML External E…8.1
- CVE-2019-19033Jalios JCMS 10 allows attackers to access any part of the we…9.8
- CVE-2019-19034Zoho ManageEngine Asset Explorer 6.5 does not validate the S…7.2
- CVE-2019-19035jhead 3.03 is affected by: heap-based buffer over-read. The …5.5
- CVE-2019-19036btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel thro…5.5
Are you affected by CVE-2019-19030?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST