PT-2022-12628 · Jfrog · Jfrog Artifactory

Published 2022-03-02 · Updated 2024-03-06 · CVE-2021-46270

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.31.10

Description The issue is related to Broken Access Control, where a project admin user can list all available repository names due to insufficient permission validation.

Recommendations For versions prior to 7.31.10, update to version 7.31.10 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-ARTIFACTORY-2021-46270

CVE-2021-46270

Affected Products

Jfrog Artifactory

References · 6

• https://osv.dev/vulnerability/CVE-2021-46270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46270 · Security Note
• https://jfrog.com/confluence/display/JFROG/CVE-2021-46270%3A+Artifactory+Project+Admin+Repository+Name+Disclosure · Vendor Advisory
• https://osv.dev/vulnerability/BIT-artifactory-2021-46270 · Vendor Advisory
• https://jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories · Vendor Advisory
• https://t.me/cibsecurity/38337 · Telegram Post