What is CVE-2018-1000425?

CVE-2018-1000425 is a high-severity vulnerability in Sonarsource Sonarqube Scanner, classified under Insufficiently Protected Credentials. CVSS score: 7.8/10. Published 2019-01-09.

How severe is CVE-2018-1000425?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Sonarsource Sonarqube Scanner

CVE-2018-1000425

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

EPSS: 0.003 (27.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sonarsource Sonarqube_scanner
N/a — versions n/a

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1000425?: CVE-2018-1000425 is a high-severity vulnerability in Sonarsource Sonarqube Scanner, classified under Insufficiently Protected Credentials. CVSS score: 7.8/10. Published 2019-01-09.
How severe is CVE-2018-1000425?: High severity. CVSS v3 base score is 7.8 out of 10.