CVE-2023-42508

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled e CVE-2023-42514.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in CVE-2023-42525.3The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase booki CVE-2023-425207.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Se CVE-2023-425217.5Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Se CVE-2023-425227.5Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecu CVE-2023-425237.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15 CVE-2023-425247.5Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security CVE-2023-425257.5Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security CVE-2023-425267.5Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Clien CVE-2023-425275.5Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose s CVE-2023-425287.8Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute