CVE-2024-6915 JFrog Artifactory Cache Poisoning
Attackers can poison the cache in JFrog Artifactory due to improper input validation, potentially serving malicious content to users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-6915?
CVE-2024-6915 is a critical vulnerability in JFrog Artifactory, published on 5 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.
Weakness: CWE-20
Which versions are affected by CVE-2024-6915?
1 open source package ship an affected version, including artifactory.
| Package | Affected | Fixed in |
|---|---|---|
artifactory Bitnami | All versions | 7.55.18, 7.59.23, 7.63.22, 7.68.22, 7.71.23, 7.77.14, 7.84.20, 7.90.6 |
How do I fix CVE-2024-6915?
Upgrade artifactory to a fixed version for your release line: 7.55.18, 7.59.23, 7.63.22 or 7.68.22.
Is CVE-2024-6915 being exploited?
There is no known exploitation of CVE-2024-6915 in the wild and no public exploit code.
Sources
Also known as BIT-artifactory-2024-6915, GHSA-995f-jhr3-5x29.