What is CVE-2024-38460?

CVE-2024-38460 is a medium-severity vulnerability in Sonarsource Sonarqube, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2024-06-16.

How severe is CVE-2024-38460?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Information disclosure in Sonarsource Sonarqube

CVE-2024-38460

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sonarsource Sonarqube
N/a — versions n/a

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

cve@mitre.org (Issue Tracking)
cve@mitre.org (Exploit, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2024-38460?: CVE-2024-38460 is a medium-severity vulnerability in Sonarsource Sonarqube, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2024-06-16.
How severe is CVE-2024-38460?: Medium severity. CVSS v3 base score is 4.9 out of 10.