CVE-2021-45730

Description

JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.

How to fix CVE-2021-45730

To remediate CVE-2021-45730, upgrade the affected package to a fixed version below.

Bitnami/artifactory—upgrade to 7.31.10 or later

Is CVE-2021-45730 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

>= 7.0.0, < 7.31.10

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References (2)

WEBnvd.nist.gov/vuln/detail/CVE-2021-45730
WEBwww.jfrog.com/confluence/display/JFROG/CVE-2021-45730%3A+Artifactory+Broken+Access+Control+on+Repository+Layouts+Configuration