Vulnerability Description
JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jfrog | Artifactory | >= 6.0.0, < 6.23.38 |
Related Weaknesses (CWE)
References
- https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45074%3A+Artifactory+BroVendor Advisory
- https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+AdvisoriesVendor Advisory
- https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45074%3A+Artifactory+BroVendor Advisory
- https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+AdvisoriesVendor Advisory
FAQ
What is CVE-2021-45074?
CVE-2021-45074 is a vulnerability with a CVSS score of 4.3 (MEDIUM). JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an ac...
How severe is CVE-2021-45074?
CVE-2021-45074 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-45074?
Check the references section above for vendor advisories and patch information. Affected products include: Jfrog Artifactory.