CVE-2023-42662 - Vulnerability Details - OpenCVE

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00279.

Key SSVC decision points have not yet been added.

Vendors	Products
Jfrog Subscribe	Artifactory Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:jfrog:artifactory::::::-::*
	cpe:2.3:a:jfrog:artifactory::::::-::*
	cpe:2.3:a:jfrog:artifactory::::::-::*
	cpe:2.3:a:jfrog:artifactory::::::-::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-47095	JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

History

Tue, 11 Mar 2025 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jfrog Jfrog artifactory
CPEs		cpe:2.3:a:jfrog:artifactory::::::-::*
Vendors & Products		Jfrog Jfrog artifactory

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: JFROG

Published: 2024-03-07T08:29:03.112Z

Updated: 2024-08-02T20:00:35.991Z

Reserved: 2023-09-12T13:51:39.870Z

Link: CVE-2023-42662

Vulnrichment

Updated: 2024-08-02T19:23:40.302Z

NVD

Status : Analyzed

Published: 2024-03-07T09:15:38.290

Modified: 2025-03-11T16:40:52.237

Link: CVE-2023-42662

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-287

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42662", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2023-09-12T13:51:39.870Z", "datePublished": "2024-03-07T08:29:03.112Z", "dateUpdated": "2024-08-02T20:00:35.991Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Artifactory", "vendor": "JFrog", "versions": [{"lessThan": "7.59.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.63.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.68.19", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.71.8", "status": "affected", "version": "7.59", "versionType": "custom"}]}], "datePublic": "2024-03-06T10:39:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.</span><br>"}], "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-03-07T08:29:03.112Z"}, "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:40.302Z"}, "title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "jfrog", "product": "artifactory", "cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.59", "status": "affected", "lessThan": "7.59.18", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.63.18", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.68.19", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.71.8", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T19:58:18.611412Z", "id": "CVE-2023-42662", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:00:35.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:40.302Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-42662", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-02T19:58:18.611412Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"], "vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "7.59", "lessThan": "7.59.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.63.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.68.19", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.71.8", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:00:27.147Z"}}], "cna": {"title": "JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JFrog", "product": "Artifactory", "versions": [{"status": "affected", "version": "7.59", "lessThan": "7.59.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.63.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.68.19", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.71.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-03-06T10:39:00.000Z", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-03-07T08:29:03.112Z"}}}, "cveMetadata": {"cveId": "CVE-2023-42662", "state": "PUBLISHED", "dateUpdated": "2024-08-02T20:00:35.991Z", "dateReserved": "2023-09-12T13:51:39.870Z", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "datePublished": "2024-03-07T08:29:03.112Z", "assignerShortName": "JFROG"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "C24F3D9E-9364-4570-96ED-433AFFE5144C", "versionEndExcluding": "7.59.18", "versionStartIncluding": "7.59.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "A8B53DA3-129E-4030-AAEA-13DE15E2D99C", "versionEndExcluding": "7.63.18", "versionStartIncluding": "7.63.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "17B54888-01AA-45AC-BCA6-2AECBFE28CE2", "versionEndExcluding": "7.68.19", "versionStartIncluding": "7.68.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "D8B7666E-8012-403A-8D42-75BD4D82F16E", "versionEndExcluding": "7.71.8", "versionStartIncluding": "7.71.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n"}, {"lang": "es", "value": "Las versiones de JFrog Artifactory 7.59 y superiores, pero inferiores a 7.59.18, 7.63.18, 7.68.19, 7.71.8 son vulnerables a un problema por el cual la interacci\u00f3n del usuario con URL especialmente manipuladas podr\u00eda provocar la exposici\u00f3n de los tokens de acceso del usuario debido a un manejo inadecuado del Integraci\u00f3n SSO basada en navegador CLI/IDE."}], "id": "CVE-2023-42662", "lastModified": "2025-03-11T16:40:52.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "reefs@jfrog.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-07T09:15:38.290", "references": [{"source": "reefs@jfrog.com", "tags": ["Vendor Advisory"], "url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "sourceIdentifier": "reefs@jfrog.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "reefs@jfrog.com", "type": "Secondary"}]}