Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

Anonymous user token generation exposure in JFrog Artifactory

Potential cache poisoning in JFrog Artifactory

Potential remote code execution on an Artifactory package service container.

Potential privilege escalation to JFrog administrator privileges

Potential authentication bypass leading to privilege escalation in Artifactory

Potential path traversal leading to unauthorized file writes

Privilege escalation via JFrog Worker event token exposure

JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series…

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when…

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when…

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to…

Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

Potential package cache integrity issue in JFrog Artifactory

Low-privilege users may remove protected Artifactory metadata

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows…

Potential unauthorized repository migration in JFrog Artifactory

Potential improper SAML signature verification in JFrog Artifactory

JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration…

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure

Integration credential holders may impersonate users in JFrog Access

Project Resource Managers may escalate privileges in JFrog Artifactory

JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available…