Vulnerability · Published May 15, 2024 · Assigned by JFROG
CVE-2024-2248JFrog Artifactory Header Injection
Medium 6.4
In plain English
A medium-severity improper input validation in Artifactory from JFrog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JFrog | Artifactory | 0 – before 7.85.00 – before 7.84.7 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H