CVE-2019-19030: Enumeration Vulnerability in Harbor

github.com/goharbor/harbor Updated 02 Oct 2025

Summary

11/02/2022

Disclosed on

CVE-2019-19030

CVE

Yes i

Fix available

Moderate

Severity

5.3

CVSS Score

CVE-2019-19030: Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030). Affects github.com/goharbor/harbor across 2 version ranges.

>= 1.7.0, < 1.10.3 >= 2.0.0, < 2.0.1

Fixed in 1.10.3 or 2.0.1, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Harbor is an open-source container image registry that provides secure storage and distribution of container images. It is written in Go and is widely used in containerized environments. The vulnerability identified as CVE-2019-19030 allows unauthenticated users to exploit an enumeration vulnerability in Harbor, enabling them to make unauthenticated calls to the Harbor API and determine the existence of various resources within the system.

Vulnerability Detail

The enumeration vulnerability in Harbor allows unauthenticated attackers to enumerate resources on the system by making use of the Harbor API. By analyzing the HTTP status code in the response, an attacker can determine which resources exist and which do not. This information includes existing projects, repositories, and more. The vulnerability has been fixed by the Harbor team.

How To Fix

Latest published version: v2.15.4+incompatible as of 23 Oct 2026

go get github.com/goharbor/harbor@v2.15.4+incompatible

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 1.7.0, < 1.10.3 1.10.3

go get github.com/goharbor/harbor@v1.10.3

>= 2.0.0, < 2.0.1 2.0.1

go get github.com/goharbor/harbor@v2.0.1

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is essential to update to the patched versions mentioned above to mitigate the risk of enumeration attacks.

Conclusion

The enumeration vulnerability in Harbor (CVE-2019-19030) allows unauthenticated attackers to enumerate resources on the system. It has been fixed in Harbor versions 1.10.3 and 2.0.1. It is crucial to update to these patched versions to mitigate the risk of enumeration attacks. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for github.com/goharbor/harbor →

FAQ

What is the impact of this vulnerability?

Successful exploitation of this vulnerability allows unauthenticated attackers to identify which resources exist in Harbor without requiring authentication for the Harbor API.

Which API resources are vulnerable to enumeration attacks?

The following API resources were found to be vulnerable: /api/chartrepo/{repo}/prov (POST), /api/chartrepo/{repo}/charts (GET, POST), /api/chartrepo/{repo}/charts/{name} (GET, DELETE), /api/chartrepo/{repo}/charts/{name}/{version} (GET, DELETE), /api/labels?name={name}&scope=p (GET), /api/repositories?project_id={id} (GET), /api/repositories/{repo_name}/ (GET, PUT, DELETE), /api/repositories/{repo_name}/tags (GET), /api/repositories/{repo_name}/tags/{tag}/manifest?version={version} (GET), /api/repositories/{repo_name}/{tag}/labels (GET), /api/projects?project_name={name} (HEAD), /api/projects/{project_id}/summary (GET), /api/projects/{project_id}/logs (GET), /api/projects/{project_id} (GET, PUT, DELETE), /api/projects/{project_id}/metadatas (GET, POST), /api/projects/{project_id}/metadatas/{metadata_name} (GET, PUT).

What are the known attack vectors for this vulnerability?

The known attack vectors involve making unauthenticated calls to the vulnerable API resources and analyzing the HTTP status codes in the responses to determine the existence of resources.

Are there any patches available for this vulnerability?

Yes, the vulnerability has been patched in Harbor versions 1.10.3 and 2.0.1. It is recommended to update to these versions to fix the vulnerability.

Is there a security policy for Harbor?

Yes, you can view the security policy for Harbor at https://github.com/goharbor/harbor/security/policy.

References

Related vulnerabilities

Recent vulnerabilities recorded for github.com/goharbor/harbor.

View all github.com/goharbor/harbor vulnerabilities →