CVE-2022-0668 - Artifactory Authentication Bypass

2022/0xxx/CVE-2022-0668.json

@@ -1,18 +1,105 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
-    "CVE_data_meta": {
-        "ID": "CVE-2022-0668",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.0",
+    "cveMetadata": {
+      "cveId": "CVE-2022-0668",
+      "assignerOrgId": "00000000-0000-4000-9000-000000000000",
+      "requesterUserId": "00000000-0000-4000-9000-000000000000",
+      "serial": 1,
+      "state": "PUBLISHED"
     },
-    "description": {
-        "description_data": [
-            {
-                "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+    "containers": {
+      "cna": {
+        "providerMetadata": {
+          "orgId": "00000000-0000-4000-9000-000000000000"
+        },
+        "title": "Artifactory Authentication Bypass",
+        "datePublic": "2023-01-02T13:30:00.000Z",
+        "problemTypes": [
+          {
+            "descriptions": [
+              {
+                "lang": "en",
+                "cweId": "CWE-274",
+                "description": "CWE-274 Improper Handling of Insufficient Privileges",
+                "type": "CWE"
+              }
+            ]
+          }
+        ],
+        "affected": [
+          {
+            "vendor": "JFrog",
+            "product": "Artifactory",
+            "versions": [
+              {
+                "status": "affected",
+                "version": "7.x.x",
+                "lessThan": "7.37.13",
+                "versionType": "custom"
+              },
+              {
+                "status": "affected",
+                "version": "6.x.x",
+                "lessThan": "6.23.41",
+                "versionType": "custom"
+              }
+            ],
+            "defaultStatus": "unaffected"
+          }
+        ],
+        "descriptions": [
+          {
+            "lang": "en",
+            "value": "JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.\n",
+            "supportingMedia": [
+              {
+                "type": "text/html",
+                "base64": false,
+                "value": "<span style=\"background-color: rgb(255, 255, 255);\">JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.</span><br>"
+              }
+            ]
+          }
+        ],
+        "references": [
+          {
+            "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0668%3A+Artifactory+Authentication+Bypass"
+          },
+          {
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0668"
+          }
+        ],
+        "metrics": [
+          {
+            "format": "CVSS",
+            "scenarios": [
+              {
+                "lang": "en",
+                "value": "GENERAL"
+              }
+            ],
+            "cvssV3_1": {
+              "version": "3.1",
+              "attackVector": "NETWORK",
+              "attackComplexity": "LOW",
+              "privilegesRequired": "NONE",
+              "userInteraction": "NONE",
+              "scope": "UNCHANGED",
+              "confidentialityImpact": "LOW",
+              "integrityImpact": "NONE",
+              "availabilityImpact": "NONE",
+              "baseSeverity": "MEDIUM",
+              "baseScore": 5.3,
+              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
             }
-        ]
+          }
+        ],
+        "source": {
+          "discovery": "UNKNOWN"
+        },
+        "x_generator": {
+          "engine": "Vulnogram 0.1.0-dev"
+        }
+      }
     }
-}
+  }