by Kastro
Paper/Archive/CVE-2024-6915

CVE-2024-6915

JFrog Artifactory — JFrog Artifactory Cache Poisoning

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
38
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 48.7.487 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.

Affected

ProductAffectedFixed inSource
Artifactory< 7.90.67.90.6CNA
Artifactory< 7.84.207.84.20CNA
Artifactory< 7.77.147.77.14CNA
Artifactory< 7.71.237.71.23CNA
Artifactory< 7.68.227.68.22CNA
Artifactory< 7.63.227.63.22CNA
Artifactory< 7.59.237.59.23CNA
Artifactory< 7.55.187.55.18CNA
artifactory≤ 7.90.6–CISA-ADP
artifactory< 7.84.207.84.20CISA-ADP
artifactory< 7.77.147.77.14CISA-ADP
artifactory< 7.71.237.71.23CISA-ADP

Scores by source

JFROG (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refjfrog.com/help/r/jfrog-release-information/jfrog-security-advisories