« Volver al listado

CVE-2021-23163

Estado: ModificadaAlta (8.8)—

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jfrog — Artifactory

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23163",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "vendor": "JFrog",
          "product": "JFrog Artifactory",
          "versions": [
            {
              "status": "affected",
              "version": "JFrog Artifactory versions before 7.33.6",
              "lessThan": "7.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "JFrog Artifactory versions before 6.23.38",
              "lessThan": "6.x",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-06T10:15:09.657",
  "references": [
    {
      "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-23163%3A++Cross-Site+Request+Forgery+on+REST+using+Basic+Auth",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2021-23163%3A++Cross-Site+Request+Forgery+on+REST+using+Basic+Auth",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x."
    },
    {
      "lang": "es",
      "value": "JFrog Artifactory versiones anteriores a 7.33.6 y 6.23.38, es vulnerable a un ataque de tipo CSRF ( Cross-Site Request Forgery) para endpoints específicos. Este problema afecta a: JFrog JFrog Artifactory JFrog versiones anteriores a 7.33.6 versiones anteriores a 7.x; JFrog Artifactory versiones anteriores a 6.23.38 versiones anteriores a 6.x"
    }
  ],
  "lastModified": "2026-06-17T03:38:21.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B9CFEAE-64C2-46A3-9487-7D9E94B35471",
              "versionEndExcluding": "6.23.38",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1DBDFF1-807F-416D-8DCB-6CCC25572B63",
              "versionEndExcluding": "7.33.6",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com"
}