CVE-2019-17444

JFrog Artifactory does not enforce default admin password change

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.

Affected

Jfrog · Artifactory

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

69.45% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-521

Published

2020-10-12

Updated

2024-09-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17444.yaml

Security advisories

• https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory

References

• CVE Record
• NVD entry