High severity · published Jan 9, 2019
CVE-2018-1000424
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Artifactory · Jfrog
through 2.16.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000424
Third Party Advisory
http://www.securityfocus.com/bid/106532
Vendor Advisory
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265
More from Artifactory
9.8
CVE-2026-82329
Potential authentication bypass leading to administrative access in Artifactory
8.8
CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
7.5
CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactory
5.3
CVE-2026-66384
Authenticated users may write data outside the intended Docker cache path
9.8
CVE-2022-0668
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated…