CVE-2024-38460 SonarQube logs sensitive information

What is CVE-2024-38460?

CVE-2024-38460 is a medium-severity vulnerability in n/a, published on 16 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

Weakness: CWE-532

Which versions are affected by CVE-2024-38460?

2 open source packages ship an affected version, including org.sonarsource.sonarqube:sonar-web. It affects 1 product.

Products include Sonarsource Sonarqube.

How do I fix CVE-2024-38460?

Upgrade org.sonarsource.sonarqube:sonar-web to 9.9.4 or later.

Is CVE-2024-38460 being exploited?

There is no known exploitation of CVE-2024-38460 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-27986 Information disclosure in n/a High 7.5
• CVE-2024-47911 SQL injection in n/a Medium 6.7
• CVE-2019-17579 Cross-site scripting in n/a Medium 6.1
• CVE-2020-28002 Auth bypass in n/a Medium 5.3
• CVE-2018-19413 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hw2c-8xgw-mf57.