CVE-2023-42662

JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens

State: Published
Severity: 9.3 Critical
Published: Mar 7, 2024
Updated: Aug 2, 2024
Reserved: Sep 12, 2023

Description

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	JFROG

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
ArtifactoryJFrog	7.59 to before 7.59.18Affected 7.59 to before 7.63.18Affected 7.59 to before 7.68.19Affected 7.59 to before 7.71.8Affected

References

https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.