CVE-2021-45721

CVE-2021-45721 affects JFrog Artifactory. Vulnerable through Reflected XSS in a Users REST API XHR parameter due to insufficient input validation. Affected versions: before 7.29.8 and before 6.23.38. Impact: potential client-side JavaScript execution. Remediation (as documented): upgrade to 7.29....

CVE-2021-46687

CVE-2021-46687 affects JFrog Artifactory: versions prior to 7.31.10 and prior to 6.23.38 are vulnerable to sensitive data exposure through the Project Administrator REST API . The underlying issue is exposed in the REST API and leads to leakage of sensitive data in affected releases. The provided...

CVE-2019-10323

The CVE-2019-10323 issue affects the Jenkins Artifactory Plugin (notably 3.2.0/3.2.1 and earlier up to 3.2.3), where doFillCredentialsIdItems lacks proper permission checks. This allows any user with Overall/Read access to enumerate credential IDs in Jenkins, causing information disclosure of sto...

CVE-2019-10322

CVE-2019-10322 affects the Jenkins Artifactory Plugin (3.2.2 and earlier). The vulnerability is due to a missing permission check in the ArtifactoryBuilder.doTestConnection endpoint, allowing any user with Overall/Read access to connect to an attacker-controlled URL using attacker-provided creden...

CVE-2019-10324

CVE-2019-10324 concerns the Jenkins Artifactory Plugin (versions 3.2.2 and earlier). The vulnerability is a cross-site request forgery (CSRF) affecting multiple release-related actions: ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBu...

CVE-2019-10321

The vulnerability CVE-2019-10321 affects the Jenkins Artifactory Plugin (notably versions 3.2.0–3.2.2) via the ArtifactoryBuilder.DescriptorImpl.doTestConnection endpoint. The root cause is missing permission checks and CSRF protection on the testConnection flow, allowing users with Overall/Read ...

CVE-2019-17444

Jfrog Artifactory prior to 6.17.0 uses default admin passwords (e.g., “password”) and does not require users to change them, enabling network-based attackers to fully compromise the instance. The issue affects Artifactory versions before 6.17.0. Remediation documented in connected sources: upgrad...

CVE-2019-9733

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass: an unauthenticated user can exploit the X-Forwarded-For header to login as the admin by abusing the access-admin reset path, bypassing IP whitelists and potentially obtaining tokens to control all artifacts and repositories. Root cau...

CVE-2021-45074

CVE-2021-45074 affects JFrog Artifactory prior to version 7.29.3 and prior to 6.23.38. The issue is a Broken Access Control where a low-privileged user can delete other known users’ OAuth tokens, forcing reauthentication on an active session or the next UI session. Connected sources include Red H...

CVE-2021-46270

CVE-2021-46270 affects JFrog Artifactory prior to version 7.31.10. The issue is a Broken Access Control where a project admin user can list all repository names due to insufficient permission validation. Impact is limited to the ability to enumerate repositories; no other data exposure is specifi...

CVE-2022-0573

Affected product: JFrog Artifactory (versions before 7.36.1 and before 6.23.41). The root cause is insecure deserialization of untrusted data in a user-provided serialized object. Consequences described across sources include Denial of Service, Privilege Escalation, and Remote Code Execution when...

CVE-2021-3860

Affected software : JFrog Artifactory before 7.25.4 (Enterprise+ deployments). Vulnerability : Blind SQL Injection by a low-privileged authenticated user due to incomplete validation when performing SQL queries. Impact : as described in multiple sources (high-severity CVSS in 3.1 context, partial...

CVE-2022-0668

JFrog Artifactory is affected by CVE-2022-0668 through versions prior to 7.37.13. The issue is an authentication bypass that could enable privilege escalation when an unauthenticated user sends a specially crafted request. Affected software: Artifactory (JFrog). Root cause: authentication bypass ...

CVE-2023-42508

CVE-2023-42508 : JFrog Artifactory versions prior to 7.66.0 are affected by an endpoint abuse vulnerability that allows unauthenticated users to send emails with manipulated email bodies via a crafted payload. Root cause described as improper header input validation leading to email manipulation....

CVE-2020-7931

In Artifactory 5.x–6.x, insecure FreeMarker template processing allows remote code execution. The root cause is the DefaultObjectWrapper exposing Java functions to templates, enabling actions such as modifying a user’s .ssh/authorized_keys. Affected versions range from 5.11.8 to 6.16.0, with patc...

CVE-2021-45730

Affected product: JFrog Artifactory prior to 7.31.10. Vulnerability: Broken Access Control allows a Project Admin to create, edit, and delete Repository Layouts, which should be restricted to Platform Administrators. Root cause (per sources): improper access control for Repository Layouts configu...

CVE-2021-41834

JFrog Artifactory is affected in versions prior to 7.28.0 and 6.23.38 by a Broken Access Control flaw that allows a low-privileged user to read and copy any artifact via the copy functionality due to improper permissions validation. The issue is documented across multiple sources (including Red H...

CVE-2020-2164

Affected software: Jenkins Artifactory Plugin 3.5.0 and earlier. Root cause: Artifactory server password stored in plaintext in the plugin’s global configuration (e.g., org.jfrog.hudson.ArtifactoryBuilder.xml) on the Jenkins master/controller file system. Impact: password exposure to users with a...

CVE-2024-2247

JFrog Artifactory is affected by a DOM-based cross-site scripting vulnerability in versions prior to 7.77.7 and 7.82.1, caused by improper handling of the import override mechanism. Impact: potential cross-site scripting via the vulnerable import override path. Affected software is Artifactory (A...

CVE-2024-3505

CVE-2024-3505 affects JFrog Artifactory Self-Hosted: versions prior to 7.77.3 are vulnerable to information disclosure where a low-privileged authenticated user can read the proxy configuration. The issue does not impact JFrog cloud deployments. Remediation: upgrade to 7.77.3 or later (as stated ...

CVE-2020-2165

The CVE-2020-2165 issue affects the Jenkins Artifactory Plugin and is caused by transmitting passwords in plain text through the global Jenkins configuration form for versions 3.6.0 and earlier, potentially exposing credentials (e.g., via browser extensions or related vectors). The problem is spe...

CVE-2023-42661

JFrog Artifactory before version 7.76.2 is affected by an Arbitrary File Write vulnerability due to insufficient validation of artifacts. The issue allows an authenticated user to cause DoS or Remote Code Execution by sending a specially crafted sequence of requests. Affected product: JFrog Artif...

CVE-2019-19937

The vulnerability concerns JFrog Artifactory before version 6.18, where there is no ability to restrict system or repository imports by any admin user in the enterprise. This lack enables “undesirable results” as described in CVE-2019-19937. The connected documents consistently identify Artifacto...

CVE-2021-23163

CVE-2021-23163 affects JFrog Artifactory. Multiple connected sources confirm a CSRF vulnerability on specific endpoints in Artifactory versions before 7.33.6 and before 6.23.38. The root cause is described as a CSRF issue; exploit details are not provided in the documents. Remediation: upgrade to...

CVE-2023-42662

CVE-2023-42662 (JFrog Artifactory) affects Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, and 7.71.8. The issue arises from improper handling of the CLI/IDE browser-based SSO integration, allowing user interaction with specially crafted URLs to expose user access tokens...

CVE-2023-42509

JFrog Artifactory versions >7.17.4 and

CVE-2016-10036

CVE-2016-10036 affects JFrog Artifactory

CVE-2018-1000206

JFrog Artifactory v5.11+ contains a UI REST CSRF vulnerability enabling actions as a logged-in user. The attack is described as a Classic CSRF likely exploitable via a crafted Flash component. Affected component: UI REST endpoints; root cause: Cross-Site Request Forgery. Impact: unauthorized acti...

CVE-2018-1000623

CVE-2018-1000623 affects JFrog Artifactory: versions prior to 6.0.3 (since 4.0.0) contain a Directory Traversal vulnerability in the “Import Repository from Zip” UI path. The vulnerable endpoint is exposed at /ui/artifactimport/upload and, via a Zip Slip flaw, can lead to directory traversal, fil...

CVE-2018-1000424

The CVE affects Jenkins Artifactory Plugin up to version 2.16.1, where ArtifactoryBuilder.java and CredentialsConfig.java stored old credentials in an insufficiently protected form before integration with the Credentials Plugin. The vulnerability allows attackers with local filesystem access to o...

CVE-2016-6501

JFrog Artifactory before 4.11 is affected by an LDAP entry poisoning vulnerability where an LDAP attribute containing a crafted serialized Java object enables remote code execution. The issue is triggered via LDAP processing and allows an attacker to execute arbitrary code on the server. Public r...

CVE-2018-19971

The CVE-2018-19971 entry applies to JFrog Artifactory Pro SAML SSO addon. Patreon details from PacketStorm show Artifactory Pro 6.5.9 is vulnerable due to improper validation of the XML signature in the SAMLResponse sent to /webapp/saml/loginRespo (SAML SSO integration). This allows an attacker t...