This vulnerability (CWE-862) in JFrog Artifactory allows an anonymous caller or a low-privilege authenticated user to learn private Release Bundle names and versions when anonymous access is enabled and the bundle name is known. The issue is a missing authorization control that permits information disclosure. The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact. No official remediation or patch is currently documented, and no known exploits are reported in the wild.

An attacker with anonymous or low-privilege access can obtain information about private Release Bundle names and versions, potentially aiding further reconnaissance. There is no impact on integrity or availability, and the confidentiality impact is limited to information disclosure of bundle metadata only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling anonymous access if not required or restricting access to trusted users only to reduce exposure.