Sonarsource » Sonarqube : Security Vulnerabilities, CVEs, CVSS score >= 2
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
Max CVSS
5.3
EPSS Score
0.10%
Published
2020-11-02
Updated
2020-11-17
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
Max CVSS
7.5
EPSS Score
36.88%
Published
2020-10-28
Updated
2024-04-11
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
Max CVSS
6.1
EPSS Score
0.08%
Published
2019-10-14
Updated
2019-10-17
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
Max CVSS
4.3
EPSS Score
0.05%
Published
2018-12-14
Updated
2019-01-03
4 vulnerabilities found