CVE-2018-1000206

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.76% chance of exploitation in the next 30 days, 53th percentile

Published

2018-07-13

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flas…

References

• CVE Record
• NVD entry

Related

• CVE-2018-1000199
• CVE-2018-1000218
• CVE-2018-1000167
• CVE-2018-1000219
• CVE-2018-1000160
• CVE-2018-1000223