CVE-2021-46687

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-359 CWE-668

Affected software

Vendor	Product	Versions
JFrog	JFrog Artifactory	>= JFrog Artifactory versions before 7.31.10, < 7.x; >= JFrog Artifactory versions before 6.23.38, < 6.x

References

https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+AdminPatch, Vendor Advisory
https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+AdvisoriesVendor Advisory
https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+AdminPatch, Vendor Advisory
https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+AdvisoriesVendor Advisory

Timeline

Published: Jul 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-466997.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overfl CVE-2021-467006.5In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2021-467016.5PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket,CVE-2021-467025.5Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended CVE-2021-467039.8In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandbox CVE-2021-467049.8In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u CVE-2021-467054.4A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attacker CVE-2021-467086.1The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuadin CVE-2021-467096.1phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).CVE-2021-467407.5The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnera CVE-2021-467417.5The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability CVE-2021-467429.1The multi-window module has a vulnerability of unauthorized insertion and tampering of Settings.Secure data.Successful exploitation of this