Skip to main content

Artifactory CVE-2018-1000206

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2018-07-13 cve@mitre.org
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 13, 2018 - 18:29 nvd
HIGH 8.8

DescriptionNVD

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.

AnalysisAI

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1. Affected products include: Jfrog Artifactory.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

CVE-2026-66384 MEDIUM POC
5.3 Aug 12

Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten

CVE-2019-9733 CRITICAL POC
9.8 Apr 11

An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2026-65617 HIGH POC
8.8 Jul 27

Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a

CVE-2020-7931 HIGH POC
8.8 Jan 23

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif

CVE-2026-65923 MEDIUM POC
6.8 Jul 27

Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository

CVE-2026-66018 MEDIUM POC
6.5 Jul 27

Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret

CVE-2016-6501 CRITICAL
9.8 Dec 09

JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser

CVE-2026-66014 CRITICAL
9.8 Jul 27

Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i

CVE-2026-82329 CRITICAL
9.8 Aug 28

Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi

CVE-2026-65921 HIGH
8.8 Jul 27

Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo

CVE-2026-69106 HIGH
8.8 Aug 12

Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met

CVE-2026-42017 HIGH
8.8 Jul 27

Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain

Share

CVE-2018-1000206 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy