CVE-2023-42509 JFrog Artifactory Sensitive Data Leakage in Repository configuration process
Improper exception handling in repository configuration may expose sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-42509?
CVE-2023-42509 is a medium-severity vulnerability in Jfrog Artifactory, published on 7 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
Weakness: CWE-755
Which versions are affected by CVE-2023-42509?
1 open source package ship an affected version, including artifactory. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
artifactory Bitnami | From 7.17.4 | 7.77.0 |
Products include Jfrog Artifactory.
How do I fix CVE-2023-42509?
Upgrade artifactory to 7.77.0 or later.
Is CVE-2023-42509 being exploited?
There is no known exploitation of CVE-2023-42509 in the wild and no public exploit code.
Other vulnerabilities in Jfrog Artifactory
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization
- CVE-2026-42018 JFrog Artifactory Improper Authentication
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
- CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Sources
Also known as BIT-artifactory-2023-42509, GHSA-3ccw-6p8h-92ch.