Jfrog ≫ Artifactory

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

An authenticated user without repository read permission may access package metadata under specific conditions.

A repository publisher without delete permission may modify protected package content under specific conditions.

A bundle writer may create misleading release promotion information under specific conditions.

An unauthenticated user may bypass authentication under specific cache conditions.

A user with access to a valid SAML response may impersonate another user under specific conditions.

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.