CVE-2022-0573

描述

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.

如何修補 CVE-2022-0573

要修補 CVE-2022-0573,請將受影響套件升級到下列已修補版本。

• Bitnami/artifactory—升級至 6.23.41 或更新版本

CVE-2022-0573 正在被利用嗎?

低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 6.0.0, < 6.23.41, >= 7.0.0, < 7.17.16, >= 7.18.0, < 7.18.12, >= 7.19.0, < 7.19.13, >= 7.21.0, < 7.21.25, >= 7.25.0, < 7.25.9, >= 7.27.0, < 7.27.15, >= 7.29.0, < 7.29.10, >= 7.31.0, < 7.31.16, >= 7.33.0, < 7.33.12, >= 7.34.0, < 7.34.4, >= 7.35.0, < 7.35.1, >= 7.36.0, < 7.36.1

CVSS 分數

參考連結(3)

• WEBnvd.nist.gov/vuln/detail/CVE-2022-0573
• WEBwww.jfrog.com/confluence/display/JFROG/CVE-2022-0573%3A+Artifactory+Vulnerable+to+Deserialization+of+Untrusted+Data
• WEBwww.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories