{"id":"CVE-2022-0573","aliases":["BIT-artifactory-2022-0573","EUVD-2022-15690","GHSA-h37x-959w-fc48"],"status":"published","title":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of...","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02121,"percentile":0.82012,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2022-05-16T14:32:04Z","modified":"2026-06-17T04:20:52Z","fixes":[{"ecosystem":"Bitnami","package":"artifactory","fixed_in":["6.23.41","7.17.16","7.18.12","7.19.13","7.21.25","7.25.9","7.27.15","7.29.10","7.31.16","7.33.12","7.34.4","7.35.1","7.36.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"artifactory","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.23.41"},{"introduced":"7.0.0"},{"fixed":"7.17.16"},{"introduced":"7.18.0"},{"fixed":"7.18.12"},{"introduced":"7.19.0"},{"fixed":"7.19.13"},{"introduced":"7.21.0"},{"fixed":"7.21.25"},{"introduced":"7.25.0"},{"fixed":"7.25.9"},{"introduced":"7.27.0"},{"fixed":"7.27.15"},{"introduced":"7.29.0"},{"fixed":"7.29.10"},{"introduced":"7.31.0"},{"fixed":"7.31.16"},{"introduced":"7.33.0"},{"fixed":"7.33.12"},{"introduced":"7.34.0"},{"fixed":"7.34.4"},{"introduced":"7.35.0"},{"fixed":"7.35.1"},{"introduced":"7.36.0"},{"fixed":"7.36.1"}]}]}],"products":[{"vendor":"jfrog","product":"artifactory"},{"vendor":"jfrog","product":"jfrog artifactory"}],"references":[{"url":"https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0573%3A+Artifactory+Vulnerable+to+Deserialization+of+Untrusted+Data","tags":["x_refsource_MISC","x_transferred","Mitigation","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0573","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h37x-959w-fc48"}],"sources":{"cve":[{"id":"CVE-2022-0573","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","status":"published","published":"2022-05-16T14:32:04Z","modified":"2024-08-02T23:32:46.384Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15690","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","status":"published","published":"2022-05-16T14:32:04Z","modified":"2024-08-02T23:32:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:26:04.481305Z"}],"ghsa":[{"id":"GHSA-h37x-959w-fc48","title":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of...","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","status":"published","published":"2022-05-17T00:01:26Z","modified":"2023-02-03T05:01:10Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:52:55.451166Z"}],"nvd":[{"id":"CVE-2022-0573","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","status":"published","published":"2022-05-16T15:15:08.497Z","modified":"2026-06-17T04:20:52.14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:20.264424Z"}],"osv":[{"id":"BIT-artifactory-2022-0573","description":"JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.","status":"published","published":"2024-03-06T10:51:05.379Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:28.70813Z"}]}}