Artifactory
Monthly
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
Repository migration operations in JFrog Artifactory expose a missing authorization check (CWE-862) that allows any authenticated low-privileged user to initiate migrations against repositories they do not have permission to access or control. Affected instances across all Artifactory versions per the CPE wildcard are subject to information disclosure of restricted artifact contents, unauthorized state changes via migration side-effects, and high-impact service disruption to artifact delivery pipelines. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the CVSS 7.6 High rating and PR:L attack vector make it a realistic insider or compromised-credential threat.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Cache poisoning in JFrog Artifactory 7.161.0-7.161.15 allows unauthenticated remote attackers to inject untrusted package content into the artifact cache under specific triggering conditions, compromising artifact integrity (I:H) and availability (A:H) with no confidentiality exposure. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory fails to validate the authenticity of content before caching it from upstream remote repositories. No public exploit has been identified at time of analysis, and the CVSS UI:R component indicates some victim interaction is required, moderating but not eliminating risk given Artifactory's central role in software supply chains.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis.
Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in JFrog Artifactory enables an authenticated Project Resource Manager to acquire broader administrative privileges under unspecified triggering conditions. The flaw, rooted in CWE-269 (Improper Privilege Management), violates role boundary enforcement within Artifactory's access control system, potentially granting full control over repositories, artifacts, and platform configuration. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis, though the CVSS 7.2 High score with full confidentiality, integrity, and availability impact underscores the post-exploitation risk.
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Privilege escalation vulnerability in JFrog Artifactory allows an attacker with an admin-provisioned account to temporarily gain platform administrator access. The flaw, reported by JFrog, is rated high severity (CVSS 7.2) and requires high privileges to exploit. No active exploitation or public exploit code is known at this time.
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Unauthorized repository read in JFrog Artifactory's Composer repository handling exposes package metadata to authenticated users who lack explicit read permissions on the affected repository. The flaw stems from a missing authorization check (CWE-862) during Composer metadata requests, meaning repository-level access controls can be silently bypassed. No active exploitation has been confirmed and no public exploit code is known, but the confidentiality impact is rated High by JFrog, and affected deployments should upgrade to the fixed Artifactory release.
Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.
Unauthorized artifact access in JFrog Artifactory allows unauthenticated network attackers to retrieve restricted artifacts under specific, high-complexity conditions. The flaw stems from a missing authorization check (CWE-862) that can be triggered without credentials, directly exposing confidential build artifacts, proprietary binaries, or sensitive packages stored in the repository. No public exploit code or active exploitation has been identified at time of analysis, and the high attack complexity requirement (AC:H) limits opportunistic mass exploitation.
Package metadata authorization bypass in JFrog Artifactory 7.161.0 through 7.161.15 allows authenticated low-privileged users to read package metadata from repositories they are explicitly denied read access to, under specific undisclosed conditions. The flaw is a missing authorization check (CWE-862) in the metadata access path, creating an unintended privilege boundary crossing within Artifactory's permission model. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified, but the network-accessible attack vector with no user interaction required makes this relevant for any multi-tenant or externally accessible Artifactory deployment.
Self-hosted JFrog Artifactory deployments using Helm may expose generated TLS private keys within rendered Kubernetes manifests, where key material persists in cleartext accessible to highly privileged local users. Affecting Artifactory versions below 7.161.16 in the 7.161.x branch and below 7.146.35 in earlier LTS branches, this CWE-312 flaw can facilitate TLS impersonation or decryption of encrypted client-to-repository communications if exposed keys are not rotated after discovery. No public exploit has been identified at time of analysis, and exploitation is structurally constrained by a requirement for pre-existing high-privilege local Kubernetes cluster access.
Information disclosure in JFrog Artifactory exposes private Release Bundle metadata to unauthorized parties under two conditions: when anonymous access is globally enabled, or when a low-privilege authenticated account is used. Affected users can enumerate the names and versions of private Release Bundles provided they already know the bundle name, bypassing expected access controls. No public exploit code has been identified and the vulnerability carries a low CVSS score of 3.1, but the missing authorization check (CWE-862) represents a genuine access control gap in sensitive artifact delivery pipelines.
Unauthorized access to restricted support information in JFrog Artifactory allows a low-privileged authenticated user to read sensitive support data under specific, undisclosed conditions. The vulnerability stems from missing authorization controls (CWE-862) on support-related endpoints, exposing information that should be restricted to administrative roles. No public exploit has been identified at time of analysis, and no CISA KEV listing was found.
Unsafe deserialization of stored session data in JFrog Artifactory allows a party with write access to that session store to achieve full confidentiality, integrity, and availability compromise under specific conditions. All versions are affected per the wildcard CPE string, and exploitation requires both high privileges and high attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in JFrog Artifactory permits authenticated low-privilege users to write files outside the intended working directory under specific conditions. Reported directly by JFrog, this CWE-22 flaw carries a CVSS 3.1 score of 4.3 (Medium), reflecting network reachability with limited integrity impact and no confidentiality or availability exposure. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Path traversal in JFrog Artifactory exposes arbitrary repository content to low-privileged users holding the cache-deploy permission under specific, unspecified triggering conditions. An authenticated repository reader with cache-deploy rights can read artifacts outside the configured upstream path boundary, potentially accessing sensitive build artifacts, credentials embedded in packages, or proprietary code across repository namespaces they should not reach. No public exploit code exists and no CISA KEV listing is present, but the CVSS confidentiality impact is rated High, making this significant in multi-tenant or shared Artifactory deployments.
Authentication bypass in JFrog Artifactory exposes protected repository resources to unauthenticated remote users when specific cache conditions are met. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any user who can reach the Artifactory instance over the network can potentially trigger this condition. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, but the unauthenticated network attack vector elevates real-world concern for internet-facing deployments.
JFrog Artifactory exposes private Puppet module metadata to authenticated users who lack repository read access, constituting a missing authorization control on a specific metadata retrieval endpoint. Any low-privilege user with a valid Artifactory account can silently enumerate Puppet module metadata from repositories they are explicitly denied access to, potentially revealing module names, versions, dependencies, and authorship details. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, though the CVSS 4.3 score reflects a real, network-exploitable authorization bypass with limited but concrete confidentiality impact.
Unauthorized NuGet metadata exposure in JFrog Artifactory allows an authenticated user who lacks repository read permission to read private NuGet feed metadata under specific conditions, constituting a missing authorization control (CWE-862). All versions covered by the CPE wildcard (cpe:2.3:a:jfrog:artifactory:*) appear affected. An attacker with any valid Artifactory account can potentially enumerate or read package metadata from private NuGet repositories they should not have visibility into, leading to information disclosure of internal package names, versions, or dependency structures. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized repository information disclosure in JFrog Artifactory allows unauthenticated remote users to read restricted repository content under specific deployment conditions. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls without credentials, confirmed by a PR:N/AV:N CVSS vector. No public exploit code and no CISA KEV listing exist at time of analysis, and the 'specific conditions' qualifier in the vendor's own description limits the realistic attack surface compared to the raw CVSS score suggests.
Incorrect authorization (CWE-863) in JFrog Artifactory allows an authenticated bundle writer to generate misleading release promotion metadata under specific operating conditions, undermining the integrity of the software release pipeline. Affected scope spans all Artifactory versions per the wildcard CPE string, impacting both self-managed and potentially cloud deployments where the bundle writer role is in use. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog, though the supply-chain integrity risk in production DevSecOps pipelines may exceed the moderate CVSS score.
Insufficient authorization in JFrog Artifactory allows an authenticated user lacking repository read permissions to access private OCI referrer metadata under specific conditions. The flaw maps to CWE-862 (Missing Authorization), meaning the access control check for OCI referrer metadata is absent or bypassed rather than misconfigured. No public exploit or active exploitation has been identified at time of analysis, but the information disclosure could expose artifact relationship graphs and supply chain metadata that organizations intend to keep private.
JFrog Artifactory contains a missing authorization flaw that allows an authenticated user holding a publisher role - but explicitly denied delete permissions - to modify protected package content under specific conditions. This integrity bypass (CWE-862) is reachable over the network without elevated privileges, making it a supply chain risk for organizations using Artifactory as their artifact repository. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized read access to restricted JFrog Artifactory content is possible when a credentialed remote repository is configured in a specific non-default manner, triggering a missing authorization check (CWE-862). The flaw affects all Artifactory versions per the CPE wildcard, exposing proprietary artifacts such as internal libraries, Docker images, or build dependencies to network-accessible requests without credential validation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the high confidentiality impact (C:H in CVSS) means successful exploitation results in full read exposure of the targeted restricted repository.
Insufficient session expiration in JFrog Artifactory (all versions per CPE wildcard) permits an attacker who holds valid credentials for a recently deleted user account to continue authenticating for a brief window after account removal. Classified under CWE-613, the flaw arises from credential invalidation logic that does not immediately propagate account deletion state under specific triggering conditions, leaving a short-lived but exploitable gap. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the network-accessible vector means any party with knowledge of the deleted account's credentials could attempt opportunistic access during this window.
Authorization bypass in JFrog Artifactory enables authenticated users with limited repository access to modify internal metadata under specific conditions, leading to integrity and availability impact. No exploitation or public proof-of-concept has been identified at this time, and EPSS data is unavailable, but the high integrity impact warrants a prompt patching response.
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.
Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows an authenticated user with read access to Cargo remote repositories to force the server to request unintended URLs and return the response, potentially exposing internal services and sensitive data. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery (SSRF) in JFrog Artifactory allows authenticated attackers to make unauthorized requests to internal services, potentially exposing internal network resources and cached response data. The vulnerability arises from improper URL validation when handling specific URLs. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS score of 6.5 reflects moderate risk with a requirement for authentication.
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.
JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
Repository migration operations in JFrog Artifactory expose a missing authorization check (CWE-862) that allows any authenticated low-privileged user to initiate migrations against repositories they do not have permission to access or control. Affected instances across all Artifactory versions per the CPE wildcard are subject to information disclosure of restricted artifact contents, unauthorized state changes via migration side-effects, and high-impact service disruption to artifact delivery pipelines. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the CVSS 7.6 High rating and PR:L attack vector make it a realistic insider or compromised-credential threat.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Cache poisoning in JFrog Artifactory 7.161.0-7.161.15 allows unauthenticated remote attackers to inject untrusted package content into the artifact cache under specific triggering conditions, compromising artifact integrity (I:H) and availability (A:H) with no confidentiality exposure. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory fails to validate the authenticity of content before caching it from upstream remote repositories. No public exploit has been identified at time of analysis, and the CVSS UI:R component indicates some victim interaction is required, moderating but not eliminating risk given Artifactory's central role in software supply chains.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the intended Docker cache directory when specific remote-repository conditions are present. The CVSS 3.1 vector scores 5.3 Medium, reflecting a real but constrained integrity risk - arbitrary filesystem writes are possible, but high attack complexity and required authentication limit opportunistic abuse. No active exploitation or public exploit code has been identified at time of analysis.
Permanent deletion of protected internal metadata across repositories in JFrog Artifactory is possible by any low-privilege authenticated user under specific, undisclosed conditions. The flaw stems from CWE-862 (Missing Authorization), where the platform fails to enforce access controls on a metadata-deletion pathway that should be restricted to privileged roles. With a CVSS score of 8.1 (High), this represents a significant integrity and availability risk - an attacker with only a standard user account can irreversibly destroy protected repository metadata, with no confidentiality exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in JFrog Artifactory enables an authenticated Project Resource Manager to acquire broader administrative privileges under unspecified triggering conditions. The flaw, rooted in CWE-269 (Improper Privilege Management), violates role boundary enforcement within Artifactory's access control system, potentially granting full control over repositories, artifacts, and platform configuration. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis, though the CVSS 7.2 High score with full confidentiality, integrity, and availability impact underscores the post-exploitation risk.
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Privilege escalation vulnerability in JFrog Artifactory allows an attacker with an admin-provisioned account to temporarily gain platform administrator access. The flaw, reported by JFrog, is rated high severity (CVSS 7.2) and requires high privileges to exploit. No active exploitation or public exploit code is known at this time.
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain tokens or credentials, leading to full compromise of the instance. The flaw stems from an event-handling weakness and can be triggered under specific, undisclosed conditions. No public exploit or active exploitation has been reported.
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage a valid token beyond its intended permissions, because the platform validates the token's signature and issuer but never enforces the token's scope. An attacker holding any legitimately issued token can therefore access resources or perform actions the token was never authorized for, yielding high confidentiality, integrity, and availability impact. This was reported by JFrog and there is no public exploit identified at time of analysis (EPSS 0.21%, percentile 11%).
Unauthorized repository read in JFrog Artifactory's Composer repository handling exposes package metadata to authenticated users who lack explicit read permissions on the affected repository. The flaw stems from a missing authorization check (CWE-862) during Composer metadata requests, meaning repository-level access controls can be silently bypassed. No active exploitation has been confirmed and no public exploit code is known, but the confidentiality impact is rated High by JFrog, and affected deployments should upgrade to the fixed Artifactory release.
Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.
Unauthorized artifact access in JFrog Artifactory allows unauthenticated network attackers to retrieve restricted artifacts under specific, high-complexity conditions. The flaw stems from a missing authorization check (CWE-862) that can be triggered without credentials, directly exposing confidential build artifacts, proprietary binaries, or sensitive packages stored in the repository. No public exploit code or active exploitation has been identified at time of analysis, and the high attack complexity requirement (AC:H) limits opportunistic mass exploitation.
Package metadata authorization bypass in JFrog Artifactory 7.161.0 through 7.161.15 allows authenticated low-privileged users to read package metadata from repositories they are explicitly denied read access to, under specific undisclosed conditions. The flaw is a missing authorization check (CWE-862) in the metadata access path, creating an unintended privilege boundary crossing within Artifactory's permission model. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified, but the network-accessible attack vector with no user interaction required makes this relevant for any multi-tenant or externally accessible Artifactory deployment.
Self-hosted JFrog Artifactory deployments using Helm may expose generated TLS private keys within rendered Kubernetes manifests, where key material persists in cleartext accessible to highly privileged local users. Affecting Artifactory versions below 7.161.16 in the 7.161.x branch and below 7.146.35 in earlier LTS branches, this CWE-312 flaw can facilitate TLS impersonation or decryption of encrypted client-to-repository communications if exposed keys are not rotated after discovery. No public exploit has been identified at time of analysis, and exploitation is structurally constrained by a requirement for pre-existing high-privilege local Kubernetes cluster access.
Information disclosure in JFrog Artifactory exposes private Release Bundle metadata to unauthorized parties under two conditions: when anonymous access is globally enabled, or when a low-privilege authenticated account is used. Affected users can enumerate the names and versions of private Release Bundles provided they already know the bundle name, bypassing expected access controls. No public exploit code has been identified and the vulnerability carries a low CVSS score of 3.1, but the missing authorization check (CWE-862) represents a genuine access control gap in sensitive artifact delivery pipelines.
Unauthorized access to restricted support information in JFrog Artifactory allows a low-privileged authenticated user to read sensitive support data under specific, undisclosed conditions. The vulnerability stems from missing authorization controls (CWE-862) on support-related endpoints, exposing information that should be restricted to administrative roles. No public exploit has been identified at time of analysis, and no CISA KEV listing was found.
Unsafe deserialization of stored session data in JFrog Artifactory allows a party with write access to that session store to achieve full confidentiality, integrity, and availability compromise under specific conditions. All versions are affected per the wildcard CPE string, and exploitation requires both high privileges and high attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in JFrog Artifactory permits authenticated low-privilege users to write files outside the intended working directory under specific conditions. Reported directly by JFrog, this CWE-22 flaw carries a CVSS 3.1 score of 4.3 (Medium), reflecting network reachability with limited integrity impact and no confidentiality or availability exposure. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Path traversal in JFrog Artifactory exposes arbitrary repository content to low-privileged users holding the cache-deploy permission under specific, unspecified triggering conditions. An authenticated repository reader with cache-deploy rights can read artifacts outside the configured upstream path boundary, potentially accessing sensitive build artifacts, credentials embedded in packages, or proprietary code across repository namespaces they should not reach. No public exploit code exists and no CISA KEV listing is present, but the CVSS confidentiality impact is rated High, making this significant in multi-tenant or shared Artifactory deployments.
Authentication bypass in JFrog Artifactory exposes protected repository resources to unauthenticated remote users when specific cache conditions are met. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any user who can reach the Artifactory instance over the network can potentially trigger this condition. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, but the unauthenticated network attack vector elevates real-world concern for internet-facing deployments.
JFrog Artifactory exposes private Puppet module metadata to authenticated users who lack repository read access, constituting a missing authorization control on a specific metadata retrieval endpoint. Any low-privilege user with a valid Artifactory account can silently enumerate Puppet module metadata from repositories they are explicitly denied access to, potentially revealing module names, versions, dependencies, and authorship details. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, though the CVSS 4.3 score reflects a real, network-exploitable authorization bypass with limited but concrete confidentiality impact.
Unauthorized NuGet metadata exposure in JFrog Artifactory allows an authenticated user who lacks repository read permission to read private NuGet feed metadata under specific conditions, constituting a missing authorization control (CWE-862). All versions covered by the CPE wildcard (cpe:2.3:a:jfrog:artifactory:*) appear affected. An attacker with any valid Artifactory account can potentially enumerate or read package metadata from private NuGet repositories they should not have visibility into, leading to information disclosure of internal package names, versions, or dependency structures. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized repository information disclosure in JFrog Artifactory allows unauthenticated remote users to read restricted repository content under specific deployment conditions. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls without credentials, confirmed by a PR:N/AV:N CVSS vector. No public exploit code and no CISA KEV listing exist at time of analysis, and the 'specific conditions' qualifier in the vendor's own description limits the realistic attack surface compared to the raw CVSS score suggests.
Incorrect authorization (CWE-863) in JFrog Artifactory allows an authenticated bundle writer to generate misleading release promotion metadata under specific operating conditions, undermining the integrity of the software release pipeline. Affected scope spans all Artifactory versions per the wildcard CPE string, impacting both self-managed and potentially cloud deployments where the bundle writer role is in use. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog, though the supply-chain integrity risk in production DevSecOps pipelines may exceed the moderate CVSS score.
Insufficient authorization in JFrog Artifactory allows an authenticated user lacking repository read permissions to access private OCI referrer metadata under specific conditions. The flaw maps to CWE-862 (Missing Authorization), meaning the access control check for OCI referrer metadata is absent or bypassed rather than misconfigured. No public exploit or active exploitation has been identified at time of analysis, but the information disclosure could expose artifact relationship graphs and supply chain metadata that organizations intend to keep private.
JFrog Artifactory contains a missing authorization flaw that allows an authenticated user holding a publisher role - but explicitly denied delete permissions - to modify protected package content under specific conditions. This integrity bypass (CWE-862) is reachable over the network without elevated privileges, making it a supply chain risk for organizations using Artifactory as their artifact repository. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized read access to restricted JFrog Artifactory content is possible when a credentialed remote repository is configured in a specific non-default manner, triggering a missing authorization check (CWE-862). The flaw affects all Artifactory versions per the CPE wildcard, exposing proprietary artifacts such as internal libraries, Docker images, or build dependencies to network-accessible requests without credential validation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the high confidentiality impact (C:H in CVSS) means successful exploitation results in full read exposure of the targeted restricted repository.
Insufficient session expiration in JFrog Artifactory (all versions per CPE wildcard) permits an attacker who holds valid credentials for a recently deleted user account to continue authenticating for a brief window after account removal. Classified under CWE-613, the flaw arises from credential invalidation logic that does not immediately propagate account deletion state under specific triggering conditions, leaving a short-lived but exploitable gap. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the network-accessible vector means any party with knowledge of the deleted account's credentials could attempt opportunistic access during this window.
Authorization bypass in JFrog Artifactory enables authenticated users with limited repository access to modify internal metadata under specific conditions, leading to integrity and availability impact. No exploitation or public proof-of-concept has been identified at this time, and EPSS data is unavailable, but the high integrity impact warrants a prompt patching response.
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.
Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows an authenticated user with read access to Cargo remote repositories to force the server to request unintended URLs and return the response, potentially exposing internal services and sensitive data. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery (SSRF) in JFrog Artifactory allows authenticated attackers to make unauthorized requests to internal services, potentially exposing internal network resources and cached response data. The vulnerability arises from improper URL validation when handling specific URLs. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS score of 6.5 reflects moderate risk with a requirement for authentication.
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. JFrog has published advisories but patch version details are not specified in the CVE record.
JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.