CVE-2024-38460

Published: Jun 16, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

Affected (2)

Products: Sonarsource: Sonarqube

Sonarsource

1 product

Sonarqube

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Sonarsource Sonarqube	Before 9.9.4
Sonarsource Sonarqube	From 10.0.0.68432 to 10.4

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (4)

https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

https://sonarsource.atlassian.net/browse/SONAR-21559

Source: cve@mitre.org

Issue Tracking

https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingVendor Advisory

https://sonarsource.atlassian.net/browse/SONAR-21559

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

Timeline

No history available yet.