JFrog Artifactory does not enforce default admin password change

Summary

Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.

Timeline

1. Oct 12, 2020, 9:55 PM UTCCVE published
2. Sep 16, 2024, 7:51 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Jfrog Artifactory

  fixed in 6.17.0

References 3