by Kastro
Paper/Archive/CVE-2023-42662

CVE-2023-42662

JFrog Artifactory — JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 41.4.414 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

Affected

ProductAffectedFixed inSource
Artifactory7.59 – < 7.59.187.59.18CNA
Artifactory7.59 – < 7.63.187.63.18CNA
Artifactory7.59 – < 7.68.197.68.19CNA
Artifactory7.59 – < 7.71.87.71.8CNA
artifactory7.59 – < 7.59.187.59.18CISA-ADP
artifactory7.59 – < 7.63.187.63.18CISA-ADP
artifactory7.59 – < 7.68.197.68.19CISA-ADP
artifactory7.59 – < 7.71.87.71.8CISA-ADP

Scores by source

JFROG (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjfrog.com/help/r/jfrog-release-information/jfrog-security-advisories