CVE-2023-42662: critical vulnerability in JFrog Artifactory
JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
JFrog · ArtifactoryRelated CVEs — JFrog Artifactory
In the same product, most dangerous first.
CVE-2023-42661HIGHJFrog Artifactory Improper input validation leads to arbitrary file writeEPSS 0.9%CVE-2024-4142CRITICALJFrog Artifactory Improper input validation within token creation flowEPSS 0.7%CVE-2024-6915CRITICALJFrog Artifactory Cache PoisoningEPSS 0.6%CVE-2021-41834MEDIUMCVE-2021-41834EPSS 0.6%CVE-2021-45730MEDIUMCVE-2021-45730EPSS 0.6%CVE-2023-42508MEDIUMJFrog Artifactory Improper header input validation leads to email manipulation sent from the platformEPSS 0.5%