What’s Vulnerable › Vulnerabilities

CVE-2021-46687

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-06 · updated 2026-06-17
• Weakness: CWE-359

Description

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

Affected products

• jfrog artifactory: from 6.0.0 before 6.23.38; from 7.0.0 before 7.31.10 — fixed in 6.23.38, 7.31.10

How to fix

Upgrade to a fixed version: jfrog artifactory 6.23.38, 7.31.10. Check the vendor advisory for mitigations.

References

• https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories
• https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin
• https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories

Get alerted when CVE-2021-46687 or the next vulnerability affects your stack