CVE-2021-46687 - OpenCVE

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:C/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Jfrog	Artifactory

Configuration 1 [-]

OR	cpe:2.3:a:jfrog:artifactory::::::-::*
	cpe:2.3:a:jfrog:artifactory::::::-::*

No data.

References

Link	Providers
https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin
https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories

History

No history.

MITRE

Status: PUBLISHED

Assigner: JFROG

Published: 2022-07-06T09:35:11

Updated: 2024-08-04T05:17:41.514Z

Reserved: 2022-02-14T00:00:00

Link: CVE-2021-46687

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-07-06T10:15:09.867

Modified: 2022-07-13T14:30:13.297

Link: CVE-2021-46687

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "JFrog Artifactory", "vendor": "JFrog", "versions": [{"lessThan": "7.x", "status": "affected", "version": "JFrog Artifactory versions before 7.31.10", "versionType": "custom"}, {"lessThan": "6.x", "status": "affected", "version": "JFrog Artifactory versions before 6.23.38", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-359", "description": "CWE-359 Exposure of Private Information ('Privacy Violation')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-06T09:35:11", "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories"}, {"tags": ["x_refsource_MISC"], "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@jfrog.com", "ID": "CVE-2021-46687", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "JFrog Artifactory", "version": {"version_data": [{"platform": "", "version_affected": "<", "version_name": "JFrog Artifactory versions before 7.31.10", "version_value": "7.x"}, {"platform": "", "version_affected": "<", "version_name": "JFrog Artifactory versions before 6.23.38", "version_value": "6.x"}]}}]}, "vendor_name": "JFrog"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-359 Exposure of Private Information ('Privacy Violation')"}]}]}, "references": {"reference_data": [{"name": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories", "refsource": "MISC", "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories"}, {"name": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin", "refsource": "MISC", "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:41.514Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin"}]}]}, "cveMetadata": {"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "assignerShortName": "JFROG", "cveId": "CVE-2021-46687", "datePublished": "2022-07-06T09:35:11", "dateReserved": "2022-02-14T00:00:00", "dateUpdated": "2024-08-04T05:17:41.514Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "8B9CFEAE-64C2-46A3-9487-7D9E94B35471", "versionEndExcluding": "6.23.38", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "E3B52A82-E930-4B10-A856-CA6F3BCB27AE", "versionEndExcluding": "7.31.10", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x."}, {"lang": "es", "value": "JFrog Artifactory versiones anteriores a 7.31.10 y 6.23.38 es vulnerable a una Exposici\u00f3n de Datos Confiables mediante la API REST del administrador del proyecto. Este problema afecta a: JFrog JFrog Artifactory versiones anteriores a 7.31.10 versiones anteriores a 7.x; JFrog Artifactory versiones anteriores a 6.23.38 versiones anteriores a 6.x"}], "id": "CVE-2021-46687", "lastModified": "2022-07-13T14:30:13.297", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 6.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "reefs@jfrog.com", "type": "Secondary"}]}, "published": "2022-07-06T10:15:09.867", "references": [{"source": "reefs@jfrog.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin"}, {"source": "reefs@jfrog.com", "tags": ["Vendor Advisory"], "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories"}], "sourceIdentifier": "reefs@jfrog.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-359"}], "source": "reefs@jfrog.com", "type": "Secondary"}]}