CVE-2019-19026: 
Harbor vulnerability analysis and mitigation

Cloud Native Computing Foundation Harbor prior to versions 1.8.6 and 1.9.3 contained a SQL injection vulnerability in the quotas section of the Harbor API. The vulnerability was discovered in December 2019 and affected the VMware Harbor Container Registry for the Pivotal Platform (GitHub Advisory, VMware Advisory).

The vulnerability exists in the quotas section of the Harbor API where an authenticated administrator could send a specially crafted SQL payload through the GET parameter 'sort'. The issue was assigned CVE-2019-19026 with a CVSS v3.1 base score of 4.9 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

Successful exploitation of this vulnerability allows an authenticated administrator to extract sensitive information from the database through SQL injection attacks (GitHub Advisory).

Users should upgrade to Harbor version 1.8.6 or 1.9.3, which contain patches for this vulnerability. There are no workarounds available for this issue. The vulnerability was responsibly reported by Cure53 and was immediately fixed by the Harbor team (GitHub Advisory, VMware Advisory).