PT-2021-22238 · Jfrog · Jfrog Artifactory

Published 2021-12-20 · Updated 2024-03-06 · CVE-2021-3860

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.25.4

Description The issue is related to Blind SQL Injection, which can be exploited by a low-privileged authenticated user due to incomplete validation when performing an SQL query.

Recommendations For versions prior to 7.25.4, update to version 7.25.4 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-ARTIFACTORY-2021-3860

CVE-2021-3860

Affected Products

Jfrog Artifactory

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-3860 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3860 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-artifactory-2021-3860 · Vendor Advisory
• https://jfrog.com/confluence/display/JFROG/CVE-2021-3860%3A+Artifactory+Low+Privileged+Blind+SQL+Injection · Vendor Advisory
• http://packetstormsecurity.com/files/177162/JFrog-Artifactory-SQL-Injection.html · Note
• https://t.me/cvenotify/24673 · Telegram Post
• https://t.me/cvenotify/71907 · Telegram Post