{"id":"CVE-2019-17444","published":"2020-10-12T21:55:55Z","modified":"2024-09-16T19:51:55Z","title":"JFrog Artifactory does not enforce default admin password change","vendor":"Jfrog","product":"Artifactory","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jfrog","product":"Artifactory","versions":[">= all, < 6.17.0"]}],"description":{"text":"Jfrog Artifactory uses default passwords (such as \"password\") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"JFrog Artifactory (JFrog's artifact repository product) does not enforce a change of the default administrative passwords, such as \"password\", which are shipped on its administrative accounts. An unauthenticated attacker with network access can use these default credentials to fully compromise the product, requiring no user interaction and only the default configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.69445,"percentile":0.9936,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-521","name":"Weak Password Requirements"}],"references":[{"url":"https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory","tags":["x_refsource_MISC"]},{"url":"https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-7835","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7835","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2019-17444","name":"Jfrog Artifactory <6.17.0 - Default Admin Password","severity":"critical","path":"http/cves/2019/CVE-2019-17444.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17444.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-10-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-17444","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9936"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}