8 matches found
CVE-2019-17444
Jfrog Artifactory prior to 6.17.0 uses default admin passwords (e.g., “password”) and does not require users to change them, enabling network-based attackers to fully compromise the instance. The issue affects Artifactory versions before 6.17.0. Remediation documented in connected sources: upgrad...
CVE-2021-3860
Affected software : JFrog Artifactory before 7.25.4 (Enterprise+ deployments). Vulnerability : Blind SQL Injection by a low-privileged authenticated user due to incomplete validation when performing SQL queries. Impact : as described in multiple sources (high-severity CVSS in 3.1 context, partial...
CVE-2020-7931
In Artifactory 5.x–6.x, insecure FreeMarker template processing allows remote code execution. The root cause is the DefaultObjectWrapper exposing Java functions to templates, enabling actions such as modifying a user’s .ssh/authorized_keys. Affected versions range from 5.11.8 to 6.16.0, with patc...
CVE-2021-41834
JFrog Artifactory is affected in versions prior to 7.28.0 and 6.23.38 by a Broken Access Control flaw that allows a low-privileged user to read and copy any artifact via the copy functionality due to improper permissions validation. The issue is documented across multiple sources (including Red H...
CVE-2024-3505
CVE-2024-3505 affects JFrog Artifactory Self-Hosted: versions prior to 7.77.3 are vulnerable to information disclosure where a low-privileged authenticated user can read the proxy configuration. The issue does not impact JFrog cloud deployments. Remediation: upgrade to 7.77.3 or later (as stated ...
CVE-2023-42661
JFrog Artifactory before version 7.76.2 is affected by an Arbitrary File Write vulnerability due to insufficient validation of artifacts. The issue allows an authenticated user to cause DoS or Remote Code Execution by sending a specially crafted sequence of requests. Affected product: JFrog Artif...
CVE-2019-19937
The vulnerability concerns JFrog Artifactory before version 6.18, where there is no ability to restrict system or repository imports by any admin user in the enterprise. This lack enables “undesirable results” as described in CVE-2019-19937. The connected documents consistently identify Artifacto...