Artifactory vulnerabilities

A repository publisher without delete permission may modify protected package content under specific conditions.

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An unauthenticated user may access restricted repository information under specific conditions.