CVE-2018-1000424 Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

What is CVE-2018-1000424?

CVE-2018-1000424 is a high-severity vulnerability in Jfrog Artifactory, published on 9 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

Weakness: CWE-522

Which versions are affected by CVE-2018-1000424?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:artifactory. It affects 1 product.

Products include Jfrog Artifactory.

How do I fix CVE-2018-1000424?

Upgrade org.jenkins-ci.plugins:artifactory to 2.16.2 or later.

Is CVE-2018-1000424 being exploited?

There is no known exploitation of CVE-2018-1000424 in the wild and no public exploit code.

Other vulnerabilities in Jfrog Artifactory

• CVE-2026-82329 JFrog Artifactory Improper Authentication Exploited Critical 9.8
• CVE-2026-42016 JFrog Artifactory Incorrect Authorization Exploited High 8.1
• CVE-2026-42018 JFrog Artifactory Improper Authentication Exploited High 7.5
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited Medium 5.3
• CVE-2019-17444 JFrog Artifactory does not enforce default admin password change Critical 9.8

All Jfrog Artifactory vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cvh8-9j4x-5v4j.