build1 publisher
Artifactory's access layer trusted an empty join key in a default install
A default self-hosted Artifactory install trusted an empty string as a join key. Because JFrog supports non-expiring tokens, an upgrade can leave a forged administrator token valid.
Publishers:dev.to
Reality
- Evidence62
- Adoption48
- Hype gap−5
- Incentives58
- Confidence60