CVE-2021-41834 : JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken A

JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.

Published 2022-05-23 07:16:13

Updated 2022-08-09 00:20:18

Source JFrog

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2021-41834

Jfrog » Artifactory »
Versions from including (>=) 7.0.0 and before (<) 7.28.0
cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*
Matching versions
Jfrog » Artifactory »
Versions before (<) 6.23.38
cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*
Matching versions

Threat overview for CVE-2021-41834

Top countries where our scanners detected CVE-2021-41834

Top open port discovered on systems with this issue 80

IPs affected by CVE-2021-41834 41

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-41834!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-41834

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-41834

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	1.6	3.6	JFrog
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-41834

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: reefs@jfrog.com (Secondary)

References for CVE-2021-41834

https://www.jfrog.com/confluence/display/JFROG/CVE-2021-41834%3A+Artifactory+Broken+Access+Control+on+Copy+Artifact

CVE-2021-41834: Artifactory Broken Access Control on Copy Artifact - JFrog - JFrog Documentation
Patch;Vendor Advisory