Exposición de Artifactory

Development
81
score de exposición
7
sitios usan
4
en explotación
5
críticos
Análisis Vexday

O histórico de vulnerabilidades do Artifactory reúne 11 CVEs catalogadas, das quais 4 são classificadas com severidade crítica — uma proporção que merece atenção no processo de gestão de risco. Nenhuma das vulnerabilidades consta atualmente no catálogo KEV da CISA, colocando a taxa de exploração ativa abaixo da média geral do catálogo, o que sugere pressão ofensiva relativamente contida no momento. Ainda assim, o EPSS mais alto observado chega a 0,69, associado à CVE-2019-17444, indicando probabilidade estatisticamente elevada de exploração para essa falha específica, que deve ser tratada como prioridade mesmo na ausência de registro formal no KEV. O tipo de falha mais frequente é CWE-20 (validação inadequada de entrada), padrão que tende a se manifestar em múltiplos vetores de ataque e reforça a necessidade de controles rigorosos na camada de entrada de dados.

CVEs

54 resultados
CVE-2026-42018HIGHAnonymous user token generation exposure in JFrog ArtifactoryEPSS 11.0%KEVCVE-2026-42016HIGHIncorrect authorization validation of user token in JFrog Artifactory allows Privilege EscalationEPSS 9.1%KEVCVE-2026-82329CRITICALPotential authentication bypass leading to administrative access in ArtifactoryEPSS 7.7%KEVCVE-2026-66384MEDIUMAuthenticated users may write data outside the intended Docker cache pathEPSS 0.6%KEVCVE-2019-17444CRITICALJFrog Artifactory does not enforce default admin password changeEPSS 69.4%CVE-2023-42661HIGHJFrog Artifactory Improper input validation leads to arbitrary file writeEPSS 0.9%CVE-2024-4142CRITICALJFrog Artifactory Improper input validation within token creation flowEPSS 0.7%CVE-2026-65617HIGHPotential remote code execution on an Artifactory package service container.EPSS 0.7%CVE-2026-66015HIGHJFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.EPSS 0.6%CVE-2026-65921HIGHPotential path traversal leading to unauthorized file writesEPSS 0.6%CVE-2026-66014HIGHPotential authentication bypass leading to privilege escalation in ArtifactoryEPSS 0.6%CVE-2024-6915CRITICALJFrog Artifactory Cache PoisoningEPSS 0.6%CVE-2021-41834MEDIUMJFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-pEPSS 0.6%CVE-2021-45730MEDIUMJFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete RepositoEPSS 0.5%CVE-2023-42662CRITICALJFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access TokensEPSS 0.5%CVE-2024-2247HIGHJFrog Artifactory Cross-Site ScriptingEPSS 0.5%CVE-2023-42509MEDIUMJFrog Artifactory Sensitive Data Leakage in Repository configuration processEPSS 0.4%CVE-2026-66018MEDIUMJFrog Artifactory build environment properties exposureEPSS 0.4%CVE-2026-65924MEDIUMServer-Side Request Forgery (SSRF) via Terraform Remote repositoryEPSS 0.4%CVE-2023-42508MEDIUMJFrog Artifactory Improper header input validation leads to email manipulation sent from the platformEPSS 0.4%