CVE-2019-10321 Jenkins Artifactory Plugin cross-site request forgery vulnerability

What is CVE-2019-10321?

CVE-2019-10321 is a medium-severity vulnerability in Jfrog Artifactory, published on 31 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weakness: CWE-352

Which versions are affected by CVE-2019-10321?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:artifactory. It affects 1 product.

Products include Jfrog Artifactory.

How do I fix CVE-2019-10321?

No fix has been published for CVE-2019-10321 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-10321 being exploited?

There is no known exploitation of CVE-2019-10321 in the wild and no public exploit code.

Other vulnerabilities in Jfrog Artifactory

• CVE-2026-82329 JFrog Artifactory Improper Authentication Exploited Critical 9.8
• CVE-2026-42016 JFrog Artifactory Incorrect Authorization Exploited High 8.1
• CVE-2026-42018 JFrog Artifactory Improper Authentication Exploited High 7.5
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited Medium 5.3
• CVE-2019-17444 JFrog Artifactory does not enforce default admin password change Critical 9.8

All Jfrog Artifactory vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8q6r-5hc6-hrr8.