Input validation

2020-01-2315:15:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.9%

JSON

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

CPENameOperatorVersion
artifactoryge6.15.0
artifactorylt6.15.1
artifactoryge6.14.0
artifactorylt6.14.2
artifactoryge6.13.0
artifactorylt6.13.2
artifactoryge6.12.0
artifactorylt6.12.3
artifactoryge6.11.0
artifactorylt6.11.7

Name	Operator	Version
artifactory	ge	6.15.0
artifactory	lt	6.15.1
artifactory	ge	6.14.0
artifactory	lt	6.14.2
artifactory	ge	6.13.0
artifactory	lt	6.13.2
artifactory	ge	6.12.0
artifactory	lt	6.12.3
artifactory	ge	6.11.0
artifactory	lt	6.11.7