CVE-2019-17444: JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JFrog Artifactoryto a version that resolves this vulnerability.Fixed in 6.17.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-17444.
What is the severity of CVE-2019-17444?
CVE-2019-17444 has a severity level of critical.
How does the vulnerability in Jfrog Artifactory occur?
The vulnerability in Jfrog Artifactory occurs due to the use of default passwords for administrative accounts and the lack of a requirement for users to change them.
Which versions of Jfrog Artifactory are affected by this vulnerability?
Jfrog Artifactory versions prior to 6.17.0 are affected by this vulnerability.
How can I fix CVE-2019-17444?
To fix CVE-2019-17444, you should upgrade Jfrog Artifactory to version 6.17.0 or higher.