Cloud customer?
Start for Free >
Upgrade in MyJFrog >
What's New in Cloud >





CVE ID

Severity 

Date Published 

Date Updated 

CVE-2021-45074

MEDIUM

03/02/202203/02/2022

Description

JFrog Artifactory prior to 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force  re-authentication on an active session or in the next UI session.

Severity: MEDIUM

CVSSv3.1 Base Score: 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected Products

Product

Affected Versions

Patched Versions

Artifactory (7.x)

< 7.29.3

7.29.3

Artifactory (6.x)

< 6.23.38

6.23.38

Required Configuration for Exposure

This vulnerability affects JFrog Artifactory deployments.

This vulnerability requires authenticated access to JFrog Artifactory and guessing the username of another user, as well as an OAuth token.



How to fix

Cloud Environments

Affected Cloud environments have already been fortified with a fixed version. No action is required for cloud instances.

Self Hosted Environments

To fix this issue, there is required action.

Upgrade your Artifactory version to one of the versions listed below:

Product

Version

Link

Artifactory (7.x)

7.29.3

https://releases.jfrog.io

Artifactory (6.x)

6.23.38

https://releases.jfrog.io


Workarounds and Mitigations

There aren’t any suggested workarounds to this issue besides upgrading to a fixed version.


Weakness Type

CWE-284: Improper Access Control


Acknowledgements

Maxime Escourbiac and Maxence Schmitt at Michelin CERT.


We Are Here For Your Questions (JFrog Support Team)

If you have questions or concerns regarding this advisory, please raise a support request at JFrog support portal.

Copyright © 2022 JFrog Ltd.