CVEvulnerability

CVE-2022-0573

8.8 HIGH Published 2022-05-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-502

Description

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.

Affected configurations

• jfrog artifactory (>= 6.0.0 < 6.23.41) • jfrog artifactory (>= 7.0.0 < 7.17.16) • jfrog artifactory (>= 7.18.0 < 7.18.12) • jfrog artifactory (>= 7.19.0 < 7.19.13) • jfrog artifactory (>= 7.21.0 < 7.21.25) • jfrog artifactory (>= 7.25.0 < 7.25.9) • jfrog artifactory (>= 7.27.0 < 7.27.15) • jfrog artifactory (>= 7.29.0 < 7.29.10) • jfrog artifactory (>= 7.31.0 < 7.31.16) • jfrog artifactory (>= 7.33.0 < 7.33.12) • jfrog artifactory (>= 7.34.0 < 7.34.4) • jfrog artifactory 7.35.0 • jfrog artifactory 7.36.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References