Sonarsource Sonarqube
8 CVEs affecting Sonarsource Sonarqube. Latest disclosed: 2025-10-10. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27986 | High | 7.5 | 2020-10-28 | SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the ve… |
CVE-2024-47911 | Medium | 6.7 | 2024-10-04 | In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQu… |
CVE-2019-17579 | Medium | 6.1 | 2019-10-14 | SonarSource SonarQube before 7.8 has XSS in project links on account/projects. |
CVE-2020-28002 | Medium | 5.3 | 2020-11-02 | In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anony… |
CVE-2024-38460 | Medium | 4.9 | 2024-06-16 | In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the UR… |
CVE-2025-62292 | Medium | 4.3 | 2025-10-10 | In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obt… |
CVE-2018-19413 | Medium | 4.3 | 2018-12-14 | A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account l… |
CVE-2013-5676 | | 2013-12-13 | The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value i… |