CVE-2019-19937

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.jfrog.com/confluence/display/RTF6X/Importing+and+ExportingVendor Advisory
https://www.jfrog.com/confluence/display/RTF6X/Release+Notes#ReleaseNotes-Artifactory6.18Release Notes
https://www.secureworks.com/research/subject/advisoriesThird Party Advisory
https://www.jfrog.com/confluence/display/RTF6X/Importing+and+ExportingVendor Advisory
https://www.jfrog.com/confluence/display/RTF6X/Release+Notes#ReleaseNotes-Artifactory6.18Release Notes
https://www.secureworks.com/research/subject/advisoriesThird Party Advisory

Timeline

Published: Mar 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-19948.8In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. T CVE-2019-199407.2Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticat CVE-2019-199415.4Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain ent CVE-2019-199427.5Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Busin CVE-2019-199437.5The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large ho CVE-2019-199446.5In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and bufPos.CVE-2019-199457.5uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap CVE-2019-199466.5The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.CVE-2019-199474.6In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb CVE-2019-199489.8In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.CVE-2019-199499.1In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_wri CVE-2019-19955.5In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy.