CVE-2021-41834

JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.

We have discovered 16 live websites that are affected by CVE-2021-41834.

Affected Software


Product	Artifactory
Category	Dev Tools
Vulnerable Versions	from 6 before 6.23.38 from 7 before 7.28
Total Vulnerable Versions	22
Vulnerable Domains	16 live websites (53.33% of Artifactory install base)

Common Weakness Enumeration

CWE-284 Improper Access Control

Distribution by Website Rank

The diagram provides a graphic representation of the correlation between the occurrence of CVE-2021-41834 and the relative popularity of websites

Available Reports

Website List

Details

Published - May 23, 2022
Updated - May 23, 2022

CWE

CWE-284

CVE References

CWE References

cwe.mitre.org

Countries

United States	2 websites

Germany	5 websites
Antiguaand Barbuda	4 websites
France	3 websites
French Polynesia	1 websites
Russia	1 websites

TLDs

.com	3 websites
.net	2 websites
.org	2 websites
.fr	1 websites
.io	1 websites
.ru	1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Geographical Distribution

The distribution of websites across the globe that are exposed to CVE-2021-41834 through included software libraries and plugins.

References

https://www.jfrog.com/confluence/display/JFROG/CVE-2021-41834%3A+Artifactory+Broken+Access+Control+on+Copy+Artifact

Websites affected by CVE-2021-41834

Top websites that are affected by CVE-2021-41834. Please click on the "Contact us" button above to get more information.

Domain	Country	Rank
********.****.org	France	,,*
**************..***.fr	France	,,*
*********.*****.****.net	Germany	,,**
*.*.pf	French Polynesia	,,**
**.*****.com	Germany	,,**
**.**.*.ag	Antiguaand Barbuda	,,**
***.**********.com	Germany	,,**
*******************.**.*.ag	Antiguaand Barbuda	,,**
***.********.io	Germany	,,**
*******.**.*.ag	Antiguaand Barbuda	,,**

See full domain list

Domain	Country	Rank
********.****.org	France	,,*
**************..***.fr	France	,,*
*********.*****.****.net	Germany	,,**
*.*.pf	French Polynesia	,,**
**.*****.com	Germany	,,**
**.**.*.ag	Antiguaand Barbuda	,,**
***.**********.com	Germany	,,**
*******************.**.*.ag	Antiguaand Barbuda	,,**
***.********.io	Germany	,,**
*******.**.*.ag	Antiguaand Barbuda	,,**