PT-2019-19828 · Jfrog · Jfrog Artifactory

Publicado 2019-04-11 · Atualizado 2020-08-24 · CVE-2019-9733

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFrog Artifactory version 6.7.3

Description An issue in JFrog Artifactory allows an unauthenticated user to login with the default credentials of the access-admin account by providing a X-Forwarded-For HTTP header to the request, bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users, including the admin account, and assume full control of all artifacts and repositories managed by Artifactory.

Recommendations For JFrog Artifactory version 6.7.3, consider disabling the access-admin account or restricting its access until a patch is available. As a temporary workaround, restrict access to the API endpoints that allow requesting authentication tokens for all users. Avoid using the default credentials of the access-admin account until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2019-9733

Produtos afetados

Jfrog Artifactory

Referências · 6

• 🔥 https://ciphertechs.com/jfrog-artifactory-advisory · Exploit
• 🔥 http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9733 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9733 · Nota de Segurança
• https://jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-9733 · Aviso do Fabricante