CVE-2021-3860 HIGH

CVE-2021-3860

Vendor Jfrog

Product JFrog Artifactory

Weakness CWE-89 · SQLi

Published December 20, 2021

Last update November 18, 2024

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.

Key dates

02Disclosure timeline

December 20, 2021 CVE published

November 18, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-3860 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2021-3860

CWE CWE-89

CVSS 8.8 / HIGH

Affected versions

Vendor Jfrog

Product JFrog Artifactory

Affected ≥ JFrog Artifactory versions before 7.25.4 with E+ license and < 7.25.4

Vendor Jfrog

Product JFrog Artifactory

Affected ≥ JFrog Artifactory versions before 6.23.30 with E+ license and < 6.23.30

CVE-2021-3860

01Description

02Disclosure timeline

03References

04Related CVE