{"id":"CVE-2019-9733","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-9733","generatedAt":"2026-11-05T03:06:37.663Z","title":"This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist…","description":"An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.","published":"2019-04-11T19:29:01.000Z","lastModified":"2026-06-17T02:44:15.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":[],"affected":["jfrog/artifactory"],"epss":{"score":0.53879,"percentile":0.99003,"date":"2026-11-03","history":[{"date":"2026-09-21","score":0.17434,"percentile":0.97049},{"date":"2026-09-22","score":0.52948,"percentile":0.98926}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 53.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.52948,"from":0.17434,"percentile":0.98926},"summary":"EPSS moved from 17.4% to 52.9% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.17434,"from":0.52948,"percentile":0.97049},"summary":"EPSS moved from 52.9% to 17.4% probability of exploitation in the next thirty days."}],"references":[{"url":"http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://www.ciphertechs.com/jfrog-artifactory-advisory/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6","tags":["Release Notes","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.ciphertechs.com/jfrog-artifactory-advisory/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-9733","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}