JFrog Security Advisories

Support

For support inquiries, visit JFrog Support.

JFrog takes the privacy and security of its customers very seriously and always strives to provide prompt notification and remediation of any vulnerabilities discovered on JFrog products. As a CVE Numbering Authority (CNA), JFrog assigns CVE identification numbers to newly discovered security vulnerabilities.

Security Advisories

CVE-2026-82329 - Potential authentication bypass leading to administrative access in Artifactory

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20

Workarounds and Mitigations

The best known remediation is to upgrade to the patched version above.

However, if you are unable to upgrade rapidly, we recommend the following workaround to reduce risk to your systems.

An additional join key is a random, hex-encoded value in the same format as your join key. Generate one with any of the following:

# Option A: OpenSSL (recommended)
openssl rand -hex 16

# Option B: Python
python3 -c "import secrets; print(secrets.token_hex(16))"

Example output (do not reuse this — generate your own): 3f8c1a9b0d2e4f6a7b8c9d0e1f2a3b4c

Keep this value secret, the same way you protect your join key.

To apply it:

1. Edit your system.yaml and add the generated additionalJoinKeys value under shared › security:
   Shell

   shared:
     security:
       ## Existing join key stays as-is; just add the line below.
       ## Use a strong, random value in the same format as your join key.
       additionalJoinKeys: "<your-strong-random-join-key-value>"

   • If you already have entries under shared: security: (for example, joinKey), keep them and simply add the additionalJoinKeys line — do not duplicate the shared: or security: headings.
   • For more than one key, use a comma-separated list: additionalJoinKeys: "key1,key2"
   • Containerized / Helm deployments can set the equivalent environment variable instead: JF_SHARED_SECURITY_ADDITIONALJOINKEYS.
2. Restart the Access service (or the JPD) for the change to take effect.

This workaround is designed to enforce that only your own keys are accepted for service registration. Your existing join key continues to work, so cluster operation is unaffected.

CVE-2026-70551 - Server-Side Request Forgery Via VCS Remote Download

Description

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.19 or 7.146.36.

CVE-2026-70550 - Potential unauthorized access to private Composer repository metadata in JFrog Artifactory

Description

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.19 or 7.146.36.

CVE-2026-70548 - SSRF In CocoaPods Via JFrog Artifactory External Dependency

Description

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.19 or 7.146.36.

CVE-2026-69104 - Potential unauthorized repository migration in JFrog Artifactory

Description

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing partial information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.19.

CVE-2026-70547 - Potential Unauthorized Metadata Exposure

Description

An authenticated user without repository read permission may access package metadata.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.16.

CVE-2026-69105 - Potential Package Cache Integrity Issue

Description

An unauthenticated attacker may cause untrusted package content to be cached, affecting artifact integrity and availability.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.161.16.

CVE-2026-69107 - Potential Unauthorized Artifact Access

Description

An unauthenticated user may access restricted artifacts under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.104.16, 7.111.14, 7.117.21, 7.125.14, 7.133.21, 7.146.8.

CVE-2026-69106 - Potential Cache Poisoning in JFrog Artifactory

Description

A low-privileged user may poison cached artifact metadata, potentially causing retrieval of untrusted content.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.28.

CVE-2026-42018 - Anonymous User Token Generation Exposure

Description

Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8.

CVE-2026-66384 - Authenticated Users May Write Data Outside the Intended Docker Cache Path

Description

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66375 - Low-Privilege Users May Remove Protected Artifactory Metadata

Description

A low-privilege authenticated user may permanently remove protected internal metadata across repositories.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66016 - Rendered Helm Manifests May Contain Generated TLS Private Keys

Description

Generated TLS private keys may be retained in rendered Helm manifests accessible to highly privileged local users.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-65926 - Private Release Bundle Versions May Be Disclosed

Description

An anonymous or low-privilege user may learn private Release Bundle names and versions when the bundle name is known.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68760 - Potential Remember-Me Authentication Bypass

Description

An unauthenticated user may bypass authentication under specific cache conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66378 - Authenticated Users May Access Private NuGet Metadata

Description

An authenticated user without repository read permission may access private NuGet metadata.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66380 - Authenticated Users May Access Private OCI Referrer Metadata

Description

An authenticated user without repository read permission may access private OCI referrer metadata.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66381 - Repository Readers May Access Content Outside Configured Upstream Paths

Description

A repository reader with cache-deploy permission may access content outside a configured upstream path.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66382 - Authenticated Users May Write Files Outside the Intended Work Directory

Description

An authenticated user may write files outside the intended Artifactory work directory.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66376 - Deleted Users May Temporarily Retain Access

Description

Credentials for a deleted user may remain valid for a short period under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68754 - Publishers Without Delete Permission Can Overwrite Docker Layer Information

Description

A repository publisher without delete permission may modify protected package content.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68757 - Potential Improper SAML Signature Verification

Description

A user with access to a valid SAML response may impersonate another user under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68756 - Potential Insecure Deserialization in JFrog Artifactory

Description

A party with write access to stored session data may affect Artifactory under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68752 - Project Resource Managers May Escalate Privileges

Description

A Project Resource Manager may gain broader administrative privileges under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35.

CVE-2026-68755 - Bundle Writers May Alter Trusted Release Information

Description

A bundle writer may create misleading release-promotion information under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68753 - Anonymous Users May Access Restricted Content Under Specific Configurations

Description

An unauthenticated user may access restricted content when a credentialed remote repository is configured in a specific way.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68759 - Integration Credential Holders May Impersonate Users

Description

A holder of a valid integration credential may impersonate other users under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-68758 - Authenticated Users May Access Restricted Support Information

Description

A low-privileged authenticated user may access restricted support information under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66377 - Anonymous Users May Access Restricted Repository Information

Description

An unauthenticated user may access restricted repository information under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-66379 - Authenticated Users May View Private Puppet Module Metadata

Description

An authenticated user may view private Puppet module metadata without repository read access.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.35, 7.161.16.

CVE-2026-65924 - Server-Side Request Forgery via Terraform Remote Repository

Description

Terraform remote repositories could issue outbound requests to arbitrary destinations and return response content.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-66015 - Authorization Flaw May Allow Authenticated Privilege Escalation

Description

An authenticated authorization flaw may grant temporary platform administrator access.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.34, 7.161.15.

CVE-2026-66014 - Potential Authentication Bypass Leading to Privilege Escalation

Description

An internal request authentication weakness may allow privilege escalation under specific conditions.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-66018 - JFrog Artifactory Build Environment Properties Exposure

Description

Build readers can access another repository's environment properties, potentially exposing build secrets.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.34, 7.161.15.

CVE-2026-65923 - Potential SSRF in Artifactory Ansible Repository Handling

Description

An Ansible repository URL-validation weakness could cause unintended server-side requests.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-65922 - Potential Unauthorized Modification of Artifactory Internal Metadata

Description

An authorization weakness could let a limited repository user write to restricted internal metadata areas.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-65921 - Potential Path Traversal Leading to Unauthorized File Writes

Description

Archive path validation allows traversal entries to be written outside the intended build-artifacts location.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-65925 - Server-Side Request Forgery via Artifactory Cargo Remote Repository

Description

A user with Cargo remote-repository read access could make Artifactory request unintended URLs and return the response.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-65617 - Potential Remote Code Execution on an Artifactory Package Service Container

Description

A package-handling deserialization weakness could let a low-privileged user affect confidentiality, integrity, and availability.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15.

CVE-2026-65616 - Potential Privilege Escalation to JFrog Administrator Privileges

Description

Incorrect refresh-token signature validation allows non-admin users to obtain a signed administrator token.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.146.27.

CVE-2026-42017 - Privilege Escalation via JFrog Worker Event Token Exposure

Description

An event-handling weakness could expose privileged authorization material to a lower-privileged user.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.133.21, 7.146.8.

CVE-2026-42016 - Incorrect User Token Authorization Validation Allows Privilege Escalation

Description

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.133.11.

CVE-2026-65618 - Improper URL Validation May Lead to SSRF

Description

Improper URL validation when handling specific URLs allows unauthorized requests from Artifactory, potentially exposing internal services and cached response data.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade JFrog Artifactory to a fixed version applicable to your release branch: 7.133.6.

CVE-2025-14830 - Improper Handling of Import Validation Mechanism Could Lead to DOM-based Cross-site Scripting

Description

JFrog Artifactory versions later than 7.94.0 but prior to version 7.117.10 (Enterprise+ and Enterprise X deployments only), are vulnerable to DOM-based cross-site scripting due to improper handling of the import validation mechanism.

Affected Products

How to Fix

• Cloud Environment: Affected Cloud environments have already been fortified. No action is required for cloud instances.
• Self-Hosted Environment: Upgrade to version 7.117.10

Workarounds and Mitigations

Users can block the Workers functionality:

• Block /ui/admin/workers/ path on WAF
• Uninstall Workers

CVE-2024-6915 - Cache Poisoning

Description

JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, and 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to Cache Poisoning.

Affected Products

How to Fix

• Self Hosted: To fix this issue, upgrade using the security patch for your required Patched Version from the following location: https://jfrog.com/download-legacy/

• Cloud:

  • Environments have already been updated to a fixed version containing additional security controls. No action is required for cloud instances.
  • Cloud customers with Hybrid deployments where their Edge resides on-premise will need to upgrade their on-premise Edge instance

Workarounds and Mitigations

Disable anonymous access or remove Deploy/Cache permissions for remote repositories for the Anonymous account.

Acknowledgements

This issue was discovered and reported by Michael Stepankin (artsploit) from GitHub Security Lab.

CVE-2024-2248 - JFrog Artifactory Header Injection

Description

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.

Affected Products

How to Fix

• Cloud Environments: JFrog Cloud environments are protected against this vulnerability with a deployed version containing the fix.
• Self-Hosted Environments: To fix this issue, take the following action. Upgrade your version of Artifactory to one of the versions listed above.

Workarounds and Mitigations

No workarounds.

Acknowledgements

This issue was discovered and reported by the researcher Master Hackor via HackerOne.

CVE-2024-4142 - Improper Input Validation in Artifactory Token Creation Flow

Critical security vulnerability CVE-2024-4142 affecting JFrog Artifactory with improper input validation that could lead to privilege escalation.

Description

An Improper input validation vulnerability was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system, an issue that could potentially lead to privilege escalation.

This issue can also be exploited in Artifactory platforms with anonymous access enabled.

Affected Products

How to Fix

• Cloud environments: No action is required for Cloud environments: the affected environments have already been protected.
• Self-Hosted environments: Update to one of the provided patched/ fixed versions listed above.

To apply the security fix, you must upgrade your version of JFrog Artifactory to one of the remediating versions.

To download and install remediating versions, click here. Please ensure that you select the correct patch for your current installation from the Product Version drop-down list.

For further details on how to upgrade to any of the remediating versions from your current installation, please refer to the JFrog Artifactory Upgrade Guide.

Acknowledgements

This issue was discovered and reported by Matthias Kaiser of Apple Information Security.

CVE-2024-3505 - Proxy Configuration Accessible to Low-privilege Users

Description

JFrog Artifactory Self-Hosted versions prior to 7.77.3 are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments.

Severity

Medium

Affected Products

How to Fix

• Cloud environments: Cloud environments are not affected by this issue.
• Self-Hosted environments: To fix this issue, take the following action. Upgrade your version of Artifactory to one of the versions listed below.

Workarounds and Mitigations

None

Acknowledgements

This issue was discovered and reported by a JFrog customer.

CVE-2024-2247: JFrog Artifactory Cross-Site Scripting

Description

JFrog Artifactory prior to version 7.77.7, is vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.

Severity

High

Affected Products

How to Fix

• Cloud Environments: JFrog cloud environments are protected. No action is required for cloud instances.
• Self Hosted Environments: Update to version 7.77.7

Workarounds and Mitigations

Customers can block the import of the vulnerable script by the browser, using a WAF / reverse proxy rule that blocks requests to the following HTTP path: /ui/externals/import-map-overrides/dist/import-map-overrides.js

Weakness Type

CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Acknowledgements

Reported by CaTz.

We are here for your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2023-42661: JFrog Artifactory Improper Input Validation Leads to Arbitrary File Write

Description

JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.

Severity

High

CVSSv3.1 Base Score: 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

Required Configuration for Exposure

This vulnerability affects all JFrog Artifactory deployments.

How to Fix

Cloud Environments: Affected Cloud environments have already been updated with a fixed version. No action is required for cloud instances.

Self Hosted Environments: To fix this issue, take the following action. Upgrade your version of Artifactory to one of the versions listed below:

Workarounds and Mitigations

No workarounds

Weakness Type

CWE-20: Improper Input validation

Acknowledgements

This issue was discovered and reported by Matthias Kaiser from Apple Information Security.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2023-42509: JFrog Artifactory Sensitive Data Leakage in Repository Configuration Process

Description

JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.

Severity

Medium

CVSSv3.1 Base Score: 6.6 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

Required Configurations for Exposure

This vulnerability affects all JFrog Artifactory deployments.

How to Fix

Cloud Environments: Affected Cloud environments have already been upgraded with a fixed version. No action is required for cloud instances.

Self Hosted Environments: To fix this issue, the following action is required.

Upgrade your version of Artifactory to one of the versions listed below:

Workarounds and Mitigations

No workarounds

Weakness Type

CWE-755: Improper Handling of Exceptional Conditions

Acknowledgements

This issue was discovered and reported by Matthias Kaiser from Apple Information Security.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2023-42662: Improper SSO Mechanism may lead to Exposure of Access Tokens

Description

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

Severity

CRITICAL

Affected Products

How to Fix

Cloud Environments: Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self Hosted Environments: Update to one of a fixed version

Workarounds and Mitigations

Block access to the CLI token exchange API endpoint:
https://Artifactory-Host/access/api/v2/authentication/jfrog_client_login/token/*

Weakness Type

CWE-287: CWE-287 Improper Authentication

Acknowledgements

N/A

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2023-42508: JFrog Artifactory Improper Header Input Validation

Description

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.

Severity: Medium

CVSSv3.1 Base Score: 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects all JFrog Artifactory deployments.

How to Fix

How to fix depends upon your environment, as follows:

• Cloud Environments
• Self Hosted Environments

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

No workarounds.

Weakness Type

CWE-20: Improper Input Validation.

Acknowledgements

This issue was discovered and reported by Iddo Eldor from Blindspot Security.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2022-0668: Artifactory Authentication Bypass

Description

JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.

Severity: Medium

CVSSv3 Score: 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects all JFrog Artifactory deployments.

How to Fix

Cloud Enviornments: Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Exploitation Status

JFrog is not aware of publicly available exploits and malicious exploitation attempts.

Weakness Type

CWE-274: Improper Handling of Insufficient Privileges.

Acknowledgements

This issue was discovered and reported by Matthias Kaiser and Jonni Passki of Apple Information Security.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-45721: Cross-Site Script (XSS) on User REST API

Description

JFrog Artifactory prior to version 7.29.8 and 6.23.38is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint.

Severity: Medium

CVSSv3.1 Score: 6.1AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Affected Products

Required Configuration

This vulnerability affects JFrog Artifactory deployments.

This issue requires an attacker to have authenticated access to JFrog Artifactory as Administrator

How to Fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE- 79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Acknowledgements

This issue was discovered and reported by Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-46687: Sensitive data exposure on proxy endpoint for Project Admin

Description

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API.

Severity: Medium

CVSSv3.1 Score: 4.9AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This issue requires an attacker to have authenticated access to JFrog Artifactory as Project Administrator.

How to Fix

Cloud Enviornments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE- 359: Exposure of Private Personal Information to an Unauthorized Actor

Acknowledgements

This issue was discovered and reported by Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-23163: Cross-Site Request Forgery on REST using Basic Auth

Description

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints.

Severity: LOW

CVSSv3.1 Score: 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This issue requires a user to enter their credentials in a www-authenticate negotiation, or have accessed some of the Artifactory REST APIs using basic credentials in the URL. (user:pass@artifactory-domain).

How to Fix

Cloud

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE-352: Cross-Site Request Forgery (CSRF)

Acknowledgements

This issue was discovered and reported by Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-41834: Artifactory Broken Access Control on Copy Artifact

Description

JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.

Severity: Medium CVSSv3 Score: 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This vulnerability requires authenticated access to JFrog Artifactory and knowing a path of a repository or artifact that the user does not have access to.

How to Fix

Cloud

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE-284: Improper Access Control

Acknowledgements

Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-45730: Artifactory Broken Access Control on Repository Layouts Configuration

Description

JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.

Severity: MEDIUM

CVSSv3.1 Base Score:6.0CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This vulnerability requires authenticated access to JFrog Artifactory and Project Admin permissions.

How to Fix

Cloud

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your Artifactory version to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE-284: Improper Access Control

Acknowledgements

Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-46270: Artifactory Project Admin Repository Name Disclosure

Description

JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin user is able to list all available repository names due to insufficient permission validation.

Severity: LOW

CVSSv3.1 Base Score:2.7AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This issue requires authenticated access to JFrog Artifactory and Project Admin permissions.

How to Fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your Artifactory version to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE-284: Improper Access Control

Acknowledgements

Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-45074: Artifactory Broken Access Control on Delete OAuth Tokens

Description

JFrog Artifactory prior to 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known usersOAuthtoken, which will force re-authentication on an active session or in the next UI session.

Severity: MEDIUM

CVSSv3.1 Base Score:4.3AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This vulnerability requires authenticated access to JFrog Artifactory and guessing the username of another user, as well as an OAuth token.

How to Fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your Artifactory version to one of the versions listed below:

Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.

Weakness Type

CWE-284: Improper Access Control

Acknowledgements

Maxime Escourbiac and Maxence Schmitt at Michelin CERT.

We Are Here For Your Questions (JFrog Support Team)****

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2021-3860: Artifactory Low Privileged Blind SQL Injection

Description

JFrog Artifactory prior to 7.25.4 (Enterprise+ subscriptions only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.

Severity: High

CVSSv3 Score: 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory and JFrog edge deployments with Enterprise+ subscriptions only.

This issue requires an attacker to have authenticated access to JFrog Artifactory.

How to Fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your version of Artifactory or Edge to one of the versions listed below:

Workarounds and Mitigations

You can mitigate the impact of this issue by following best practices and disabling anonymous access to the JFrog Platform. Please review the best practices for disabling anonymous access in the JFrog knowledge base.

Exploitation Status

JFrog is not aware of publicly available exploits and malicious exploitation attempts.

Weakness Type

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

Acknowledgements

This issue was discovered and reported by a JFrog customer.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

CVE-2022-0573: Artifactory Vulnerable to Deserialization of Untrusted Data

Description

JFrog Artifactory prior to 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.

Severity: HIGH

CVSSv3.1 Base Score:8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This issue requires an attacker to have authenticated access to JFrog Artifactory.

If your environment permits anonymous access, there is a higher potential of exposure to the vulnerability.

How to Fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self-Hosted Environments

To fix this issue, there is required action.

Upgrade your Artifactory version to one of the versions listed below:

Workarounds and Mitigations

You can mitigate the impact of this issue by following best practices and disabling anonymous access to the JFrog Platform. Please review the best practices for disabling anonymous access in the JFrog Knowledge Base.

Weakness Type

CWE-502: Deserialization of Untrusted Data

Acknowledgements

This issue was discovered and reported by Matthias Kaiser and Jonni Passki of Apple Information Security.

We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.