Skip to content
Fencer Vulns
high 8.8

CVE-2020-7931 json

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authori…

published 2020-01-23 6 y ago modified 2026-06-17 4 mo ago also BIT-artifactory-2020-7931 , EUVD-2020-28861

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.5%
EPSS 5.5% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

Patch / fix

  • bitnami artifactory 5.11.8, 6.1.6, 6.3.9, 6.7.8, 6.8.17, 6.9.6, 6.10.9, 6.11.7, 6.12.3, 6.13.2, 6.14.2, 6.15.1
  • jfrog artifactory 5.11.8, 6.1.6, 6.3.9, 6.7.8, 6.8.17, 6.9.6, 6.10.9, 6.11.7, 6.12.3, 6.13.2, 6.14.2, 6.15.1

Exploit prediction

5.49% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0006.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami artifactory
<5.11.8
>=6.0.0, <6.1.6
>=6.2.0, <6.3.9
>=6.4.0, <6.7.8
>=6.8.0, <6.8.17
>=6.9.0, <6.9.6
>=6.10.0, <6.10.9
>=6.11.0, <6.11.7
>=6.12.0, <6.12.3
>=6.13.0, <6.13.2
>=6.14.0, <6.14.2
>=6.15.0, <6.15.1
5.11.8
6.1.6
6.3.9
6.7.8
6.8.17
6.9.6
6.10.9
6.11.7
6.12.3
6.13.2
6.14.2
6.15.1

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.