GitHub Advisoryadvisory · Maven

GHSA-hw2c-8xgw-mf57 SonarQube logs sensitive information

MEDIUM Published 2024-06-16 Modified 2024-06-17 Official page ↗
Aliases
CVE-2024-38460
Ecosystem
Maven
Packages
org.sonarsource.sonarqube:sonar-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-06-17

Affected packages

• Maven org.sonarsource.sonarqube:sonar-web: < 9.9.4 → fixed in 9.9.4

Description

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

Related

Alias · CVE (1)

  • CVE-2024-38460 In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References