CVE-2019-17444

published 2020-10-12

CVE-2019-17444: Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
jfrog	artifactory	< 6.17.0	6.17.0
jfrog	artifactory	>= all < 6.17.0	6.17.0

Detection & IOCs extracted from sources · hover to see the quote

url POST {{path}}/ui/auth/login↗

command {"user":"admin","password":"password","type":"login"}↗

path /ui/auth/login↗

path /artifactory/ui/auth/login↗

• → Successful exploitation returns HTTP 200 with JSON body containing both '"name":"admin"' and '"admin":true' fields, confirming default credentials are accepted. ↗
• → The login endpoint is reachable at both the root path (/ui/auth/login) and under the /artifactory sub-path (/artifactory/ui/auth/login); probe both during detection. ↗
• → The login request must include the headers 'Content-Type: application/json;charset=UTF-8' and 'X-Requested-With: XMLHttpRequest' to be processed correctly by the endpoint. ↗
• → Shodan query 'cpe:"cpe:2.3:a:jfrog:artifactory"' can be used to identify exposed Artifactory instances for mass scanning. ↗

• · The vulnerability only affects JFrog Artifactory versions strictly prior to 6.17.0; instances running 6.17.0 or later are not affected. ↗
• · The default credential pair is specifically username 'admin' with password 'password'; other default passwords may also exist but only this pair is confirmed in the sources. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-521