CVE-2019-10324 Cross-site request forgery vulnerability in Jenkins Artifactory Plugin

What is CVE-2019-10324?

CVE-2019-10324 is a medium-severity vulnerability in Jfrog Artifactory, published on 31 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.

Weakness: CWE-352

Which versions are affected by CVE-2019-10324?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:artifactory. It affects 1 product.

Products include Jfrog Artifactory.

How do I fix CVE-2019-10324?

Upgrade org.jenkins-ci.plugins:artifactory to 3.2.3 or later.

Is CVE-2019-10324 being exploited?

There is no known exploitation of CVE-2019-10324 in the wild and no public exploit code.

Other vulnerabilities in Jfrog Artifactory

• CVE-2026-82329 JFrog Artifactory Improper Authentication Exploited Critical 9.8
• CVE-2026-42016 JFrog Artifactory Incorrect Authorization Exploited High 8.1
• CVE-2026-42018 JFrog Artifactory Improper Authentication Exploited High 7.5
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited Medium 5.3
• CVE-2019-17444 JFrog Artifactory does not enforce default admin password change Critical 9.8

All Jfrog Artifactory vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mqj3-fc39-73fj.