Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

Description

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.

Affected Products

Also Affects

Downstream vendors/products affected by this vulnerability

References

• https://docs.jfrog.com/releases/docs/jfrog-security-advisories(vendor-advisory)
• https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases(vendor-advisory)

Related News (2 articles)