CVE-2020-7931
HIGH 8.8EPSS 5.5%
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P - EPSS
- 5.49% chance of exploitation in the next 30 days, 92th percentile
- Published
- 2020-01-23
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
- gquere/CVE-2020-793150★ · 2020-03-12