CVE-2020-27986 Information disclosure in n/a

What is CVE-2020-27986?

CVE-2020-27986 is a high-severity vulnerability in n/a, published on 28 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.

Weakness: CWE-312, CWE-306

Which versions are affected by CVE-2020-27986?

It affects 1 product.

Products include Sonarsource Sonarqube.

How do I fix CVE-2020-27986?

No fix has been published for CVE-2020-27986 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-27986 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-27986 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2024-47911 SQL injection in n/a Medium 6.7
• CVE-2019-17579 Cross-site scripting in n/a Medium 6.1
• CVE-2020-28002 Auth bypass in n/a Medium 5.3
• CVE-2024-38460 SonarQube logs sensitive information Medium 4.9
• CVE-2018-19413 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-56fw-8mg6-5hvp.