CVE-2018-1000206 Cross-site request forgery in n/a
An attacker can perform actions as a logged-in user via CSRF in JFrog Artifactory UI endpoints, requiring the victim to run a malicious flash component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-1000206?
CVE-2018-1000206 is a high-severity vulnerability in Jfrog Artifactory, published on 13 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.
Weakness: CWE-352
Which versions are affected by CVE-2018-1000206?
It affects 1 product.
Products include Jfrog Artifactory.
How do I fix CVE-2018-1000206?
No fix has been published for CVE-2018-1000206 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1000206 being exploited?
There is no known exploitation of CVE-2018-1000206 in the wild and no public exploit code.
Other vulnerabilities in Jfrog Artifactory
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization
- CVE-2026-42018 JFrog Artifactory Improper Authentication
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
- CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Sources
Also known as GHSA-hqm8-r6qj-h62q.