7.5
CVE-2026-42018
- EPSS 0.3%
- Veröffentlicht 12.08.2026 17:43:21
- Zuletzt bearbeitet 18.08.2026 19:16:48
- CVE-Watchlists
- Unerledigt
Anonymous user token generation exposure in JFrog Artifactory
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerjfrog
≫
Produkt
artifactory
Default Statusunaffected
Version
0
Version <
7.111.20
Status
affected
Version
7.117.0
Version <
7.117.27
Status
affected
Version
7.125.0
Version <
7.125.19
Status
affected
Version
7.133.0
Version <
7.133.28
Status
affected
Version
7.146.0
Version <
7.146.8
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.222 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| reefs@jfrog.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://docs.jfrog.com/releases/docs/jfrog-security-advisories
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases