CVE-2019-9733 in the critical feed json
An issue was discovered in JFrog Artifactory 6.7.3.
published 2019-04-11 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-19098
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.9%
- EPSS 53.9% chance of exploitation in 30 days, percentile 99%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.
Exploit prediction
53.88% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template JFrog Artifactory 6.7.3 - Admin Login Bypass nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html referenced PoC, tagged "exploit" by a source, unverified
- ciphertechs.com https://www.ciphertechs.com/jfrog-artifactory-advisory/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
packetstormsecurity.com
/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html
exploit, third-party-advisory, vdb-entry
-
ciphertechs.com
/jfrog-artifactory-advisory/
exploit, third-party-advisory
-
jfrog.com
/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6
release-notes, vendor-advisory
Sources
- CVE List CVE-2019-9733
- NVD CVE-2019-9733
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.