CVE-2022-0573: 
Artifactory vulnerability analysis and mitigation

JFrog Artifactory versions before 7.36.1 and 6.23.41 were identified with a critical security vulnerability (CVE-2022-0573) involving insecure deserialization of untrusted data. The vulnerability was disclosed on May 16, 2022, affecting multiple versions of the Artifactory software platform (NVD Database).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) with a CVSS v3.1 base score of 8.8 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD Database).

The vulnerability can lead to multiple severe security impacts including Denial of Service (DoS), Privilege Escalation, and Remote Code Execution when a specially crafted request is sent by a low-privileged authenticated user (NVD Database).

JFrog has released security patches to address this vulnerability. Users are advised to upgrade to Artifactory version 7.36.1 or 6.23.41 or later versions to mitigate the risk (NVD Database).