Vulnerability threat dossier
An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.
VTP analyst assessment
JFrog Artifactory 6.7.3 accepts a spoofed X-Forwarded-For header to bypass localhost-only password recovery. An unauthenticated attacker can then log in with default recovery credentials.
1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
No public exploitation reporting or remediation detail is included.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
If you use Artifactory 6.7.3, apply vendor remediation and restrict console access.
First-party deterministic correlation
The request shares exploitation-associated characteristics with CVE-2019-9733, but the evidence does not identify one CVE with sufficient confidence.
Basis: deterministic technical candidate
First-party deterministic correlation
The request shares exploitation-associated characteristics with CVE-2019-9733, but the evidence does not identify one CVE with sufficient confidence.
Basis: deterministic technical candidate
VTP deterministic assessment
EPSS is 0.53; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Predictive context changed; this is not exploitation evidence.
Original publications
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.