CVE-2020-35193

Published: Dec 16, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Affected (26)

Products: Sonarsource: Sonarqube Docker Image

Sonarsource

1 product

Sonarqube Docker Image

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Sonarsource Sonarqube Docker Image	Version 4.5.7
Sonarsource Sonarqube Docker Image	Version 5.5
Sonarsource Sonarqube Docker Image	Version 5.6.1
Sonarsource Sonarqube Docker Image	Version 5.6.2
Sonarsource Sonarqube Docker Image	Version 5.6.3
Sonarsource Sonarqube Docker Image	Version 5.6.4
Sonarsource Sonarqube Docker Image	Version 5.6.5
Sonarsource Sonarqube Docker Image	Version 5.6.7
Sonarsource Sonarqube Docker Image	Version 5.6
Sonarsource Sonarqube Docker Image	Version 6.0
Sonarsource Sonarqube Docker Image	Version 6.1
Sonarsource Sonarqube Docker Image	Version 6.2
Sonarsource Sonarqube Docker Image	Version 6.3.1
Sonarsource Sonarqube Docker Image	Version 6.3
Sonarsource Sonarqube Docker Image	Version 6.4
Sonarsource Sonarqube Docker Image	Version 6.5
Sonarsource Sonarqube Docker Image	Version 6.6
Sonarsource Sonarqube Docker Image	Version 6.7.1
Sonarsource Sonarqube Docker Image	Version 6.7.2
Sonarsource Sonarqube Docker Image	Version 6.7.3
Sonarsource Sonarqube Docker Image	Version 6.7.4
Sonarsource Sonarqube Docker Image	Version 6.7.5
Sonarsource Sonarqube Docker Image	Version 6.7
Sonarsource Sonarqube Docker Image	Version 7.0
Sonarsource Sonarqube Docker Image	Version 7.1
Sonarsource Sonarqube Docker Image	Version lts

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/koharin/koharin2/blob/main/CVE-2020-35193

Source: cve@mitre.org

Third Party Advisory

https://github.com/koharin/koharin2/blob/main/CVE-2020-35193

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.