CVE-2019-9733

CVE-2019-9733 is a critical vulnerability affecting JFrog Artifactory versions up to 6.7.3. It allows an unauthenticated attacker to bypass IP whitelist restrictions by manipulating the X-Forwarded-For header, enabling login to the default access-admin account. This account can then request authentication tokens for all users, including the administrator, leading to full control over Artifactory. With a CVSS score of 9.8 (Critical) and an EPSS score indicating high exploitability, the potential impact is severe, encompassing complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, a Nuclei template for this vulnerability exists, suggesting readily available exploit code, though there is no evidence of active exploitation or significant community discussion.