CVEvulnerability
CVE-2018-1000206
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-07-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.
Affected configurations
• jfrog artifactory (>= 5.11.0 < 6.1.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/ Exploit, Third Party Advisory
- https://www.jfrog.com/jira/browse/RTFACT-17004 Issue Tracking, Patch, Vendor Advisory
- https://www.jfrog.com/jira/secure/ReleaseNote.jspa?projectId=10070&version=19581 Release Notes, Vendor Advisory
- https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/ Exploit, Third Party Advisory
- https://www.jfrog.com/jira/browse/RTFACT-17004 Issue Tracking, Patch, Vendor Advisory
- https://www.jfrog.com/jira/secure/ReleaseNote.jspa?projectId=10070&version=19581 Release Notes, Vendor Advisory