CVE-2018-19413: SonarSource SonarQube API - Exposure of Sensitive Information
Summary
CVE-2018-19413: Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API. Affects org.sonarsource.sonarqube:sonar-plugin-api versions < 7.5. Fixed in 7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SonarSource SonarQube is a web application used for continuous code quality management. It provides various features such as code analysis, bug detection, and vulnerability scanning. The SonarQube API allows users to interact with the application programmatically. The vulnerability in the API of SonarSource SonarQube before version 7.4 exposes sensitive information to unauthorized actors.
Vulnerability Detail
The vulnerability arises due to improperly configured access controls in the SonarQube API. This flaw allows an authenticated user to discover sensitive information, including valid user-account logins. Non-administrator users can access the externalIdentity field through the API, leading to potential misuse of this information in subsequent attacks against the system. The vulnerability has a CVSS score of 4.3 (Medium severity).
How To Fix
Minimum fixed version
7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to SonarQube version 7.4 or later.
Conclusion
The vulnerability in the SonarSource SonarQube API exposes sensitive information to unauthorized actors. To mitigate this issue, it is crucial to upgrade to SonarQube version 7.4 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.sonarsource.sonarqube:sonar-plugin-api →
FAQ
SonarSource SonarQube is a web application used for continuous code quality management. It provides features such as code analysis, bug detection, and vulnerability scanning.
The vulnerability allows authenticated users to access sensitive information, such as valid user-account logins. This information can be used in subsequent attacks against the system.
To fix this vulnerability, upgrade SonarSource SonarQube to version 7.4 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
The CVSS score of this vulnerability is 4.3 (Medium severity).
