CVE-2021-46687: 
Artifactory vulnerability analysis and mitigation

JFrog Artifactory versions prior to 7.31.10 and 6.23.38 were found to be vulnerable to Sensitive Data Exposure through the Project Administrator REST API. The vulnerability was disclosed on July 6, 2022, affecting both version 7.x (before 7.31.10) and version 6.x (before 6.23.38) of JFrog Artifactory (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity. Under CVSS v2.0, it received a base score of 6.8 (Medium) with the vector (AV:N/AC:L/Au:S/C:C/I:N/A:N). The vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) (NVD).

The vulnerability allows for sensitive data exposure through the Project Administrator REST API, potentially compromising confidential information. The CVSS scores indicate high confidentiality impact but no impact on integrity or availability of the system (NVD).

The vulnerability has been addressed in JFrog Artifactory versions 7.31.10 and 6.23.38. Users are advised to upgrade to these or later versions to mitigate the risk (NVD).