CVE-2020-7931

Published: Jan 23, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

Affected (12)

Products: Jfrog: Artifactory

Jfrog

1 product

Artifactory

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Jfrog Artifactory	From 6.10.0 to 6.10.9
Jfrog Artifactory	From 6.11.0 to 6.11.7
Jfrog Artifactory	From 6.12.0 to 6.12.3
Jfrog Artifactory	From 6.13.0 to 6.13.2
Jfrog Artifactory	From 6.14.0 to 6.14.2
Jfrog Artifactory	From 6.15.0 to 6.15.1
Jfrog Artifactory	From 6.8.0 to 6.8.17
Jfrog Artifactory	From 6.9.0 to 6.9.6
Jfrog Artifactory	Before 5.11.8
Jfrog Artifactory	From 6.0.0 to 6.1.6
Jfrog Artifactory	From 6.2.0 to 6.3.9
Jfrog Artifactory	From 6.4.0 to 6.7.8

References (4)

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.jfrog.com/confluence/display/RTF/Release+Notes

Source: cve@mitre.org

Release NotesVendor Advisory

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.jfrog.com/confluence/display/RTF/Release+Notes

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.