What’s Vulnerable › Vulnerabilities

CVE-2021-23163

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-06 · updated 2026-06-17
• Weakness: CWE-352

Description

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

Affected products

• jfrog artifactory: from 6.0.0 before 6.23.38; from 7.0.0 before 7.33.6 — fixed in 6.23.38, 7.33.6

How to fix

Upgrade to a fixed version: jfrog artifactory 6.23.38, 7.33.6. Check the vendor advisory for mitigations.

References

• https://www.jfrog.com/confluence/display/JFROG/CVE-2021-23163%3A++Cross-Site+Request+Forgery+on+REST+using+Basic+Auth
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories
• https://www.jfrog.com/confluence/display/JFROG/CVE-2021-23163%3A++Cross-Site+Request+Forgery+on+REST+using+Basic+Auth
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories

Get alerted when CVE-2021-23163 or the next vulnerability affects your stack