JFrog Artifactory 7.94.x < 7.117.10 XSS

medium Nessus Plugin ID 367883

Synopsis

An application installed on the remote host is affected by a cross-site scripting vulnerability.

Description

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.94.x prior to 7.117.10. It is, therefore, affected by a cross-site scripting (XSS) vulnerability due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to JFrog Artifactory version 7.117.10 or later.

Plugin Details

Severity: Medium

ID: 367883

File Name: jfrog_artifactory_CVE-2025-14830.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/20/2026

Updated: 10/20/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.39

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: cpe:/a:jfrog:artifactory

Required KB Items: installed_sw/Artifactory

Patch Publication Date: 7/31/2025

Vulnerability Publication Date: 1/4/2026

Reference Information

CVE: CVE-2025-14830

Detections

Analytics