PT-2022-12300 · Jfrog · Jfrog Artifactory

Published 2022-03-02 · Updated 2024-03-06 · CVE-2021-45074

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.29.3 JFrog Artifactory versions prior to 6.23.38

Description The issue is related to Broken Access Control, where a low-privileged user can delete other known users' OAuth token. This action forces a reauthentication on an active session or in the next UI session.

Recommendations For versions prior to 7.29.3, update to version 7.29.3 or later. For versions prior to 6.23.38, update to version 6.23.38 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-ARTIFACTORY-2021-45074

CVE-2021-45074

Affected Products

Jfrog Artifactory

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-45074 · Security Note
• https://jfrog.com/confluence/display/JFROG/CVE-2021-45074%3A+Artifactory+Broken+Access+Control+on+Delete+OAuth+Tokens · Vendor Advisory
• https://jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45074 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-artifactory-2021-45074 · Vendor Advisory
• https://t.me/cvenotify/34396 · Telegram Post
• https://t.me/cibsecurity/38333 · Telegram Post