Show filters
7 Total Results
Displaying 1-7 of 7
Sort by:
Attacker Value
Unknown

CVE-2024-38460

Disclosure Date: June 16, 2024 (last updated August 08, 2024)
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
Attacker Value
Unknown

CVE-2020-35193

Disclosure Date: December 16, 2020 (last updated February 22, 2025)
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
Attacker Value
Unknown

CVE-2020-28002

Disclosure Date: November 02, 2020 (last updated February 22, 2025)
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
Attacker Value
Unknown

CVE-2020-27986

Disclosure Date: October 28, 2020 (last updated February 22, 2025)
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
Attacker Value
Unknown

CVE-2019-17579

Disclosure Date: October 14, 2019 (last updated November 27, 2024)
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
Attacker Value
Unknown

CVE-2018-1000425

Disclosure Date: January 09, 2019 (last updated November 27, 2024)
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.
0
Attacker Value
Unknown

CVE-2018-19413

Disclosure Date: December 14, 2018 (last updated November 27, 2024)
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
0