CVE-2019-3990

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	Harbor	Harbor versions 1.9.1 and prior

References

https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhgPatch, Third Party Advisory
https://www.tenable.com/security/research/tra-2019-50Third Party Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhgPatch, Third Party Advisory
https://www.tenable.com/security/research/tra-2019-50Third Party Advisory

Timeline

Published: Dec 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-39927.5ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server CVE-2019-39937.5ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's CVE-2019-39947.5ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can CVE-2019-39957.5ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated at CVE-2019-39966.5ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.CVE-2019-39974.6Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair CVE-2019-39985.5Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify t CVE-2019-39997.8Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attac CVE-2019-40007.8Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attack CVE-2019-40017.8Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.CVE-2019-40089.8API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being wr CVE-2019-40115.4IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in