CVE-2019-19026 SQL Injection in Cloud Native Computing Foundation Harbor
Attackers can execute arbitrary SQL commands via project quotas in Harbor Container Registry, potentially accessing or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19026?
CVE-2019-19026 is a medium-severity SQL injection vulnerability in n/a, published on 20 Mar 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
Weakness: CWE-89
Which versions are affected by CVE-2019-19026?
5 open source packages ship an affected version, including github.com/goharbor/harbor. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/goharbor/harbor Go | From 1.7.0 | 1.8.6, 1.9.3 |
github.com/goharbor/harbor Go | From 1.7.0 | 1.8.6 |
github.com/goharbor/harbor Go | From 1.7.0 | 1.8.6 |
github.com/goharbor/harbor Go | From 1.9.0 | 1.9.3 |
github.com/goharbor/harbor Go | From 1.9.0 | 1.9.3 |
Products include Linuxfoundation Harbor, Pivotal Vmware Harbor Registry.
How do I fix CVE-2019-19026?
Upgrade github.com/goharbor/harbor to a fixed version for your release line: 1.8.6 or 1.9.3.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-19026 being exploited?
There is no known exploitation of CVE-2019-19026 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor
- CVE-2019-19023 Privilege Escalation in Cloud Native Computing Foundation Harbor
- CVE-2019-19025 Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
- CVE-2017-17697 Server-side request forgery in n/a
- CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
Sources
Also known as GHSA-rh89-vvrg-fg64, GHSA-w4x5-jqq4-qc8x, GO-2022-0883.