Jfrog Artifactory vulnerabilities, page 2
78 vulnerabilities
Known vulnerabilities in Jfrog Artifactory, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-2248jfrogartifactory
EPSS score0.27%
A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.CVE-2024-4142jfrogartifactoryEPSS score0.67%
An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory.
Due to this vulnerability, users with low privileges may gain administrative access to the system.
This issue can also be exploited in Artifactory platforms with anonymous access enabled.CVE-2024-6915jfrogartifactoryEPSS score0.60%
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.CVE-2024-3505jfrogartifactory+1EPSS score0.41%
JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration.
This does not affect JFrog cloud deployments.CVE-2019-19937jfrogartifactoryEPSS score1.49%
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."CVE-2019-9733jfrogartifactoryEPSS score53.88%
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.CVE-2019-17444jfrogartifactoryEPSS score69.45%
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.CVE-2019-10321jenkins projectjenkins artifactory plugin+2EPSS score0.88%
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.CVE-2019-10322jenkins projectjenkins artifactory plugin+2EPSS score1.79%
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.CVE-2019-10324jenkins projectjenkins artifactory plugin+2EPSS score0.75%
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.CVE-2019-10323jenkins projectjenkins artifactory plugin+2EPSS score1.84%
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.CVE-2026-65921jfrogartifactoryEPSS score0.59%
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.CVE-2026-65926jfrogartifactoryEPSS score0.24%
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.CVE-2026-65924jfrogartifactoryEPSS score0.41%
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.CVE-2026-65617jfrogartifactoryEPSS score0.65%
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.CVE-2026-65616jfrogartifactoryEPSS score0.37%
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.CVE-2026-65618jfrogartifactoryEPSS score0.35%
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.CVE-2026-65923jfrogartifactoryEPSS score0.35%
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests.
The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.CVE-2026-65922jfrogartifactoryEPSS score0.31%
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.CVE-2026-65925jfrogartifactoryEPSS score0.40%
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.