This vulnerability involves improper input validation (CWE-20) in JFrog Artifactory. Specifically, a low-privileged user can manipulate cached artifact metadata, potentially causing other users or systems to consume untrusted or malicious content. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability with network attack vector, low attack complexity, and no user interaction required. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

If exploited, this vulnerability could allow an attacker with low privileges to inject or poison artifact metadata caches, causing downstream consumers to retrieve and potentially execute untrusted or malicious artifacts. This compromises the confidentiality, integrity, and availability of the software supply chain managed by Artifactory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict low-privileged user access to artifact metadata management where possible and monitor for unusual artifact metadata changes.