Insecure Deserialization Vulnerability in JFrog Artifactory by JFrog
CVE-2022-0573

8.8HIGH

Key Information:

Vendor

Jfrog

Status
Jfrog Artifactory
Vendor
CVE Published:
16 May 2022

What is CVE-2022-0573?

JFrog Artifactory versions prior to 7.36.1 and 6.23.41 exhibit a vulnerability that allows insecure deserialization of untrusted data. This flaw occurs when a low privileged authenticated user sends a specially crafted request, leading to possible Denial of Service (DoS), privilege escalation, and remote code execution due to inadequate validation of user-supplied serialized objects.

Affected Version(s)

JFrog Artifactory JFrog Artifactory versions before 7.36.1 < 7.36.1

JFrog Artifactory JFrog Artifactory versions before 6.23.41 < 6.23.41

References

https://www.jfrog.com/confluence/display/JFROG/JFrog+Secu...
x_refsource_MISC
https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0...
x_refsource_MISC

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.