title: JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
description: JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.
problem types: CWE-287 Improper Authentication
affected:
{
defaultStatus: unaffected
product: Artifactory
vendor: JFrog
versions:
lessThan: 7.59.18, status: affected, version: 7.59, versionType: custom
lessThan: 7.63.18, status: affected, version: 7.59, versionType: custom
lessThan: 7.68.19, status: affected, version: 7.59, versionType: custom
lessThan: 7.71.8, status: affected, version: 7.59, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL