Skip to content
Fencer Vulns
medium 5.3

CVE-2019-19030 json

Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)

published 2022-02-11 4 y ago modified 2026-09-10 1 mo ago also GHSA-q9x4-q76f-5h5j , GO-2022-0704 , EUVD-2022-1148

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

Patch / fix

  • go github.com/goharbor/harbor 1.10.3, 2.0.1, 2.0.1+incompatible
  • linuxfoundation harbor 1.10.3, 2.0.1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5j referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/goharbor/harbor
>=1.7.0, <1.10.3
>=2.0.0, <2.0.1
>=2.0.0+incompatible, <2.0.1+incompatible
1.10.3
2.0.1
2.0.1+incompatible

Classification

Weakness
  • CWE-204 Observable Response Discrepancy

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.