Vulnerability · Published May 16, 2022 · Assigned by JFROG
CVE-2022-0573
High 8.8
In plain English
A high-severity unsafe deserialization in JFrog Artifactory from JFrog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.1%top 18.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JFrog | JFrog Artifactory | JFrog Artifactory versions before 7.36.1 – before 7.36.1JFrog Artifactory versions before 6.23.41 – before 6.23.41 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H