CVE-2023-42661

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-426626.5JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction w CVE-2023-426636.5Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read CVE-2023-426647.2A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit V CVE-2023-426665.3The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attack CVE-2023-426677.8Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable esc CVE-2023-426686.7Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chi CVE-2023-426696.5A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. Thi CVE-2023-426706.5A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disrupti CVE-2023-426715.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426725.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426735.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc CVE-2023-426745.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loc