What is CVE-2019-19937?

CVE-2019-19937 is a high-severity vulnerability in Jfrog Artifactory, classified under Missing Authorization. CVSS score: 7.2/10. Published 2020-03-16.

How severe is CVE-2019-19937?

High severity. CVSS v3 base score is 7.2 out of 10.

Auth bypass in Jfrog Artifactory

CVE-2019-19937

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."

Vulnerability class: Broken Access Control

EPSS: 0.015 (71.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jfrog Artifactory
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Release Notes)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-19937?: CVE-2019-19937 is a high-severity vulnerability in Jfrog Artifactory, classified under Missing Authorization. CVSS score: 7.2/10. Published 2020-03-16.
How severe is CVE-2019-19937?: High severity. CVSS v3 base score is 7.2 out of 10.