CVE-2021-45721: 
Artifactory vulnerability analysis and mitigation

JFrog Artifactory versions prior to 7.29.8 and 6.23.38 were identified with a Reflected Cross-Site Scripting (XSS) vulnerability through one of the XHR parameters in the Users REST API endpoint. The vulnerability also affects JFrog Artifactory versions before 7.36.1 and versions before 6.23.41 (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue, specifically involving improper neutralization of input during web page generation. It received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and requiring user interaction (NVD).

The vulnerability could allow attackers to execute malicious scripts in the context of the user's browser session, potentially leading to unauthorized access to sensitive information and manipulation of user data. The CVSS scoring indicates low confidentiality and integrity impacts, with no impact on availability (NVD).

Users are advised to upgrade to JFrog Artifactory version 7.29.8 or later for the 7.x series, or version 6.23.38 or later for the 6.x series. These versions contain the necessary security patches to address the XSS vulnerability (NVD).