CVE-2019-9733: jfrog artifactory
Vulnerability summary
CVE-2019-9733 is a critical (CVSS 9.8) vulnerability in jfrog artifactory. EPSS estimates a 53.88% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 11-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
53.88%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+36.45 pp
From 17.43% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (ciphertechs.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Jfrog1 product
- artifactory6.7.3
1 vendor · 1 product
References
3 links- packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry