{"schemaVersion":3,"id":"CVE-2021-46687","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.","dates":{"published":"2022-07-06T09:35:11.000Z","modified":"2024-08-04T05:17:41.514Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00848,"percentile":0.57648,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.03099999999999995,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00817},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00848,"percentile":0.57648}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00817,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00841,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00848,"percentile":0.57648}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-359","name":"Exposure of Private Personal Information to an Unauthorized Actor","description":"The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/359.html"},{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere","description":"The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/668.html"}],"affected":[{"vendor":"jfrog","product":"artifactory","name":"Artifactory","label":"artifactory","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.0.0, < 6.23.38","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.31.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.0.0, < 6.23.38 | ≥ 7.0.0, < 7.31.10","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"artifactory","label":"Artifactory","category":"server-app"}},"hubHref":"/vendor/jfrog/artifactory"},{"vendor":"jfrog","product":"jfrog artifactory","name":"JFrog Artifactory","label":"jfrog artifactory","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ JFrog Artifactory versions before 7.31.10, < 7.x","noFixRecorded":false,"fixedIn":null},{"text":"≥ JFrog Artifactory versions before 6.23.38, < 6.x","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ JFrog Artifactory versions before 7.31.10, < 7.x | ≥ JFrog Artifactory versions before 6.23.38, < 6.x","eol":null,"hubHref":"/vendor/jfrog/jfrog_artifactory"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories","label":"www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories","hostname":"www.jfrog.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46687%3A+Sensitive+data+exposure+on+proxy+endpoint+for+Project+Admin","label":"www.jfrog.com/confluence/…","hostname":"www.jfrog.com","tags":["X Refsource MISC","Patch","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-07-06T09:35:11.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T05:17:41.514Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T20:40:23.227Z","stale":false,"partial":false}}