CVEvulnerability

CVE-2024-38460

6.5 MEDIUM Published 2024-06-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-06-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532

Description

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

Affected configurations

• sonarsource sonarqube (< 9.9.4) • sonarsource sonarqube (>= 10.0.0.68432 < 10.4)

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References