CVE-2023-42662

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42662", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2023-09-12T13:51:39.870Z", "datePublished": "2024-03-07T08:29:03.112Z", "dateUpdated": "2024-08-02T20:00:35.991Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Artifactory", "vendor": "JFrog", "versions": [{"lessThan": "7.59.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.63.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.68.19", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.71.8", "status": "affected", "version": "7.59", "versionType": "custom"}]}], "datePublic": "2024-03-06T10:39:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.</span><br>"}], "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-03-07T08:29:03.112Z"}, "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:40.302Z"}, "title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "jfrog", "product": "artifactory", "cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.59", "status": "affected", "lessThan": "7.59.18", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.63.18", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.68.19", "versionType": "custom"}, {"version": "7.59", "status": "affected", "lessThan": "7.71.8", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T19:58:18.611412Z", "id": "CVE-2023-42662", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:00:35.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:40.302Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-42662", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-02T19:58:18.611412Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"], "vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "7.59", "lessThan": "7.59.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.63.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.68.19", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.71.8", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:00:27.147Z"}}], "cna": {"title": "JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JFrog", "product": "Artifactory", "versions": [{"status": "affected", "version": "7.59", "lessThan": "7.59.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.63.18", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.68.19", "versionType": "custom"}, {"status": "affected", "version": "7.59", "lessThan": "7.71.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-03-06T10:39:00.000Z", "references": [{"url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2024-03-07T08:29:03.112Z"}}}, "cveMetadata": {"cveId": "CVE-2023-42662", "state": "PUBLISHED", "dateUpdated": "2024-08-02T20:00:35.991Z", "dateReserved": "2023-09-12T13:51:39.870Z", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "datePublished": "2024-03-07T08:29:03.112Z", "assignerShortName": "JFROG"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Artifactory", "vendor": "JFrog", "versions": [{"lessThan": "7.59.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.63.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.68.19", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.71.8", "status": "affected", "version": "7.59", "versionType": "custom"}]}], "source": "reefs@jfrog.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "artifactory", "vendor": "jfrog", "versions": [{"lessThan": "7.59.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.63.18", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.68.19", "status": "affected", "version": "7.59", "versionType": "custom"}, {"lessThan": "7.71.8", "status": "affected", "version": "7.59", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "C24F3D9E-9364-4570-96ED-433AFFE5144C", "versionEndExcluding": "7.59.18", "versionStartIncluding": "7.59.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "A8B53DA3-129E-4030-AAEA-13DE15E2D99C", "versionEndExcluding": "7.63.18", "versionStartIncluding": "7.63.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "17B54888-01AA-45AC-BCA6-2AECBFE28CE2", "versionEndExcluding": "7.68.19", "versionStartIncluding": "7.68.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*", "matchCriteriaId": "D8B7666E-8012-403A-8D42-75BD4D82F16E", "versionEndExcluding": "7.71.8", "versionStartIncluding": "7.71.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.\n"}, {"lang": "es", "value": "Las versiones de JFrog Artifactory 7.59 y superiores, pero inferiores a 7.59.18, 7.63.18, 7.68.19, 7.71.8 son vulnerables a un problema por el cual la interacci\u00f3n del usuario con URL especialmente manipuladas podr\u00eda provocar la exposici\u00f3n de los tokens de acceso del usuario debido a un manejo inadecuado del Integraci\u00f3n SSO basada en navegador CLI/IDE."}], "id": "CVE-2023-42662", "lastModified": "2026-06-17T06:24:12.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "reefs@jfrog.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-42662", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-02T19:58:18.611412Z", "version": "2.0.3"}}]}, "published": "2024-03-07T09:15:38.290", "references": [{"source": "reefs@jfrog.com", "tags": ["Vendor Advisory"], "url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}], "sourceIdentifier": "reefs@jfrog.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "reefs@jfrog.com", "type": "Secondary"}]}

{}

{}