CVE-2023-42662

Published: Mar 7, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

Affected (4)

Products: Jfrog: Artifactory

Jfrog

1 product

Artifactory

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Jfrog Artifactory	From 7.59.0 to 7.59.18
Jfrog Artifactory	From 7.63.5 to 7.63.18
Jfrog Artifactory	From 7.68.7 to 7.68.19
Jfrog Artifactory	From 7.71.2 to 7.71.8

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

Source: reefs@jfrog.com

Vendor Advisory

https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.