CVE-2024-2248: JFrog Artifactory Header Injection

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-15 · updated 2026-06-17
Weakness: CWE-20

Description

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.

Affected products

jfrog artifactory: before 7.85.0(\SaaS\); before 7.84.7\(Selff-Hosted\) — fixed in 7.84.7\(Selff-Hosted\), 7.85.0(\SaaS\)

How to fix

Upgrade to a fixed version: jfrog artifactory 7.84.7\(Selff-Hosted\), 7.85.0(\SaaS\). Check the vendor advisory for mitigations.

References

https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories

Get alerted when CVE-2024-2248 or the next vulnerability affects your stack