Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2019-17444

JFrog Artifactory does not enforce default admin password change

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jfrog Artifactory

  • 7.xunaffected
  • all to < 6.17.0affected

References