CVE-2024-4142 - OpenCVE

An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with anonymous access enabled.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

History

No history.

MITRE

Status: PUBLISHED

Assigner: JFROG

Published: 2024-05-01T20:18:23.916Z

Updated: 2024-08-01T20:33:52.579Z

Reserved: 2024-04-24T18:42:54.505Z

Link: CVE-2024-4142

Vulnrichment

Updated: 2024-08-01T20:33:52.579Z

NVD

Status : Awaiting Analysis

Published: 2024-05-01T21:15:51.000

Modified: 2024-05-02T13:27:25.103

Link: CVE-2024-4142

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4142", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2024-04-24T18:42:54.505Z", "datePublished": "2024-05-01T20:18:23.916Z", "dateUpdated": "2024-08-01T20:33:52.579Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Artifactory", "vendor": "JFrog", "versions": [{"lessThan": "7.84.6", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.77.11", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.71.21", "status": "affected", "version": "0 ", "versionType": "custom"}, {"lessThan": "7.68.21", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.63.21", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.59.22", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.55.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><span style=\"background-color: var(--wht);\">An Improper input validation vulnerability that could potentially lead to </span><span style=\"background-color: var(--wht);\">privilege escalation</span><span style=\"background-color: var(--wht);\"> was discovered in </span>JFrog Artifactory.<br></p><p>Due to this vulnerability, users with low privileges may gain administrative access to the system.<br></p><p>This issue can also be exploited in Artifactory platforms with anonymous access enabled.</p>"}], "value": "An Improper input validation vulnerability that could potentially lead to privilege escalation\u00a0was discovered in JFrog Artifactory.\n\nDue to this vulnerability, users with low privileges may gain administrative access to the system.\n\nThis issue can also be exploited in Artifactory platforms with anonymous access enabled.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-05-01T20:21:40.250Z"}, "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "source": {"discovery": "EXTERNAL"}, "title": "JFrog Artifactory Improper input validation within token creation flow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-02T15:24:56.754799Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*"], "vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:55:28.563Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.579Z"}, "title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.579Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-02T15:24:56.754799Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*"], "vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T15:24:33.402Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "JFrog Artifactory Improper input validation within token creation flow", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JFrog", "product": "Artifactory", "versions": [{"status": "affected", "version": "0", "lessThan": "7.84.6", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "7.77.11", "versionType": "custom"}, {"status": "affected", "version": "0 ", "lessThan": "7.71.21", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "7.68.21", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "7.63.21", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "7.59.22", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "7.55.17", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An Improper input validation vulnerability that could potentially lead to privilege escalation\u00a0was discovered in JFrog Artifactory.\n\nDue to this vulnerability, users with low privileges may gain administrative access to the system.\n\nThis issue can also be exploited in Artifactory platforms with anonymous access enabled.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p><span style=\"background-color: var(--wht);\">An Improper input validation vulnerability that could potentially lead to </span><span style=\"background-color: var(--wht);\">privilege escalation</span><span style=\"background-color: var(--wht);\"> was discovered in </span>JFrog Artifactory.<br></p><p>Due to this vulnerability, users with low privileges may gain administrative access to the system.<br></p><p>This issue can also be exploited in Artifactory platforms with anonymous access enabled.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-05-01T20:21:40.250Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4142", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:33:52.579Z", "dateReserved": "2024-04-24T18:42:54.505Z", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "datePublished": "2024-05-01T20:18:23.916Z", "assignerShortName": "JFROG"}, "dataVersion": "5.1"}