PT-2024-28016 · Sonarqube · Sonarqube

Thornablegumpture · Published 2024-06-16 · Updated 2024-08-07 · CVE-2024-38460

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SonarQube versions prior to 10.4 SonarQube version 9.9.4 LTA and earlier

Description The issue concerns the potential exposure of encrypted values in cleartext as part of URL parameters in logs, such as SonarQube Access Logs and Proxy Logs. This occurs due to the Settings Encryption feature.

Recommendations For SonarQube versions prior to 10.4, update to version 10.4 or later. For SonarQube version 9.9.4 LTA and earlier, update to version 9.9.4 LTA or later. As a temporary workaround, consider restricting access to logs that may contain sensitive information, such as SonarQube Access Logs and Proxy Logs, to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-38460

GHSA-HW2C-8XGW-MF57

Affected Products

Sonarqube

References · 8

• 🔥 https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38460 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38460 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hw2c-8xgw-mf57 · Vendor Advisory
• https://github.com/SonarSource/sonarqube · Note
• https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01 · Note
• https://t.me/cvenotify/83426 · Telegram Post
• https://sonarsource.atlassian.net/browse/SONAR-21559 · Note