TI-2021-02791 Aliases CVE-2021-3860 GHSA-p7mv-x2rc-847f

SQL injection in JFrog Artifactory

MEDIUM 42CWE-89Published 2021-12-20 · Updated 2024-11-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01081 65th percentileScored 2026-11-07

Fix Fixed JFrog Artifactory (JFrog): 7.25.4, 6.23.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
JFrog	JFrog Artifactory	JFrog Artifactory versions before 7.25.4 with E+ license to before 7.25.4; JFrog Artifactory versions before 6.23.30 with E+ license to before 6.23.30	7.25.4, 6.23.30	Patch available	CNA

JFrog Artifactory VendorJFrog Affected JFrog Artifactory versions before 7.25.4 with E+ license to before 7.25.4; JFrog Artifactory versions before 6.23.30 with E+ license to before 6.23.30 Fixed in 7.25.4, 6.23.30 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jfrog:artifactory:::::enterprise\+:::*	before 6.23.30; 7.11.0 to before 7.11.8; 7.12.0 to before 7.12.10; 7.17.0 to before 7.17.14; 7.18.0 to before 7.18.11; 7.19.0 to before 7.19.12; 7.21.0 to before 7.21.14; 7.23.0 to before 7.23.8; 7.24.0 to before 7.24.7; 7.25.0 to before 7.25.4	Vulnerable	JFrog

cpe:2.3:a:jfrog:artifactory:*:*:*:*:enterprise\+:*:*:* Versions before 6.23.30; 7.11.0 to before 7.11.8; 7.12.0 to before 7.12.10; 7.17.0 to before 7.17.14; 7.18.0 to before 7.18.11; 7.19.0 to before 7.19.12; 7.21.0 to before 7.21.14; 7.23.0 to before 7.23.8; 7.24.0 to before 7.24.7; 7.25.0 to before 7.25.4 Vulnerable ·JFrog

Remediation

Fix · CNA JFrog Artifactory (JFrog) Fixed in 7.25.4, 6.23.30

Timeline

2026-10-02 Threatist record created from CVE-2021-3860
2026-10-03 Alias added: GHSA-p7mv-x2rc-847f

References

Patch 1

https://www.jfrog.com/confluence/display/JFROG/CVE-2021-3860%3A+Artifactory+Low+Privileged+Blind+SQL+Injection

Other 1

http://packetstormsecurity.com/files/177162/JFrog-Artifactory-SQL-Injection.html

TI-2026-56777 Potential authentication bypass leading to administrative access in Artifactory KEVCVSS 3.1CRITICAL 9.8
TI-2026-30404 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation KEVCVSS 3.1HIGH 8.8
TI-2026-30406 Anonymous user token generation exposure in JFrog Artifactory KEVCVSS 3.1HIGH 7.5
TI-2026-47149 Authenticated users may write data outside the intended Docker cache path KEVCVSS 3.1MEDIUM 5.3
TI-2019-13025 JFrog Artifactory does not enforce default admin password change CVSS 3.1CRITICAL 9.8
TI-2019-07126 An issue was discovered in JFrog Artifactory 6.7.3. CVSS 3.0CRITICAL 9.8

See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences