{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Artifactory","vendor":"JFrog","versions":[{"lessThan":"7.85.0","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.84.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"reefs@jfrog.com"},{"affectedData":[{"cpes":["cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"artifactory","vendor":"jfrog","versions":[{"lessThan":"7.85.0(\\SaaS\\)","status":"affected","version":"0","versionType":"custom"},{"lessThan":"7.84.7\\(Selff-Hosted\\)","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email."},{"lang":"es","value":"Una vulnerabilidad de inyección de encabezado en la plataforma JFrog en versiones inferiores a 7.85.0 (SaaS) y 7.84.7 (autohospedado) puede permitir que actores de amenazas se apoderen de la cuenta del usuario final al hacer clic en una URL especialmente manipulada y enviada al correo electrónico del usuario de la víctima."}],"id":"CVE-2024-2248","lastModified":"2026-06-17T07:24:07.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.7,"source":"reefs@jfrog.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-06-10T19:29:25.930609Z","version":"2.0.3"}}]},"published":"2024-05-15T13:15:26.250","references":[{"source":"reefs@jfrog.com","url":"https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories"}],"sourceIdentifier":"reefs@jfrog.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"reefs@jfrog.com","type":"Secondary"}]}