An event-handling vulnerability in JFrog Artifactory could allow a low-privileged user to access sensitive authorization credentials, leading to full system compromise.

This is an exposure of sensitive information to an unauthorized actor (CWE-200). The vulnerability is triggered during event handling processes, allowing an attacker with low privileges to gain access to privileged authorization material.

This vulnerability poses a severe risk as it allows privilege escalation or unauthorized access to sensitive artifacts and system configurations. With a CVSS score of 8.8, this represents a high risk to the confidentiality, integrity, and availability of the Artifactory instance and any integrated development pipelines.

Immediate Action: Upgrade JFrog Artifactory to version 7.133.21 or 7.146.8, depending on the current release branch.

Proactive Monitoring: Monitor system logs for unusual access patterns or unauthorized attempts to retrieve authorization tokens and credentials.

Compensating Controls: Implement strict network segmentation and ensure that only authorized users have access to the Artifactory management interface while the patch is being deployed.

Public Exploit Available: No

Due to the critical nature of Artifactory in software supply chains, this vulnerability must be treated with high urgency. Administrators should apply the vendor-provided patches immediately to prevent potential unauthorized access to sensitive build and deployment credentials.