Database/Container, Kubernetes & orchestration

Harbor: Non-admin users create admin accounts via POST /api/users

CVE-2019-16097Container, Kubernetes & orchestrationcurated

Impact

Non-admin users create admin accounts via POST /api/users; full registry takeover

Who can reach it

Any registered registry user

What to do

Upgrade Harbor; audit the admin user list

References

https://nvd.nist.gov/vuln/detail/CVE-2019-16097

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.