CVE-2018-1000206

    Dashboard / Vulnerabilities / CVE-2018-1000206

    CVE-2018-1000206

    Published: 13 Jul 2018Last Modified: 8 Jul 2026

    Summary:

    Details: JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.

    References: https://www.jfrog.com/jira/secure/ReleaseNote.jspa?projectId=10070&version=19581, https://www.jfrog.com/jira/browse/RTFACT-17004, https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cb99e22edfd2d15c223f3de15ad58f0d8e92b52e
    Fixed -9f06d6095a09e0d635c4a6ef3b06a17d35523b66

    Affected versions

    6.0.3
    6.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High