CVE-2021-23163

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
JFrogJFrog Artifactory>= JFrog Artifactory versions before 7.33.6, < 7.x; >= JFrog Artifactory versions before 6.23.38, < 6.x

References

Timeline

Published
Jul 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-231659.8A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary coCVE-2021-231668.7A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and wCVE-2021-231676.8Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the CommCVE-2021-231686.5Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enabCVE-2021-231698.8A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw toCVE-2021-231710.0Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The suppCVE-2021-231725.5A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitabCVE-2021-231734.3The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensiCVE-2021-231744.8Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.CVE-2021-231758.2NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access cCVE-2021-231766.5Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier alCVE-2021-231777.8An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. A