What’s Vulnerable › Vulnerabilities

CVE-2019-17444: JFrog Artifactory does not enforce default admin password change

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 69.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-12 · updated 2026-06-17
• Weakness: CWE-521

Description

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.

Affected products

• jfrog artifactory: before 6.17.0 — fixed in 6.17.0

How to fix

Upgrade to a fixed version: jfrog artifactory 6.17.0. Check the vendor advisory for mitigations.

References

• https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory
• https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory

Get alerted when CVE-2019-17444 or the next vulnerability affects your stack