Vulnerability in Jfrog Artifactory
CVE-2019-9733
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.
EPSS: 0.529 (98.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Jfrog Artifactory — versions 6.7.3
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-9733?
- CVE-2019-9733 is a critical-severity vulnerability in Jfrog Artifactory. CVSS score: 9.8/10. Published 2019-04-11.
- How severe is CVE-2019-9733?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-9733 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.