CVE-2021-45074: 
Artifactory vulnerability analysis and mitigation

JFrog Artifactory versions before 7.29.3 and 6.23.38 were identified with a Broken Access Control vulnerability, tracked as CVE-2021-45074. The vulnerability was disclosed and published on March 2, 2022, affecting multiple versions of the JFrog Artifactory software (NVD).

The vulnerability is classified as a Broken Access Control issue (CWE-284) where a low-privileged user could delete other known users' OAuth tokens. The severity of this vulnerability has been assessed with multiple CVSS scores: NVD assigned a CVSS v3.1 Base Score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, while JFrog assigned a score of 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (NVD).

When exploited, this vulnerability forces reauthentication on an active session or in the next UI session when a malicious user deletes another user's OAuth token. This impacts the availability and integrity of authentication mechanisms within the Artifactory system (NVD).

The vulnerability has been patched in JFrog Artifactory versions 7.29.3 and 6.23.38. Users are advised to upgrade to these versions or later to mitigate the vulnerability (NVD).