CVE-2024-4142: critical vulnerability in JFrog Artifactory
JFrog Artifactory Improper input validation within token creation flow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9epss 0.7%
An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory.
Due to this vulnerability, users with low privileges may gain administrative access to the system.
This issue can also be exploited in Artifactory platforms with anonymous access enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
JFrog · ArtifactoryRelated CVEs — JFrog Artifactory
In the same product, most dangerous first.
CVE-2023-42661HIGHJFrog Artifactory Improper input validation leads to arbitrary file writeEPSS 0.9%CVE-2024-6915CRITICALJFrog Artifactory Cache PoisoningEPSS 0.6%CVE-2021-41834MEDIUMCVE-2021-41834EPSS 0.6%CVE-2021-45730MEDIUMCVE-2021-45730EPSS 0.6%CVE-2023-42508MEDIUMJFrog Artifactory Improper header input validation leads to email manipulation sent from the platformEPSS 0.5%CVE-2023-42662CRITICALJFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access TokensEPSS 0.5%