Information Exposure Affecting org.sonarsource.sonarqube:sonar-web package, versions [,9.9.4.87374) [10.0.0.68432,10.4.0.87286)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (20th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSONARSOURCESONARQUBE-7266570
- published 17 Jun 2024
- disclosed 16 Jun 2024
- credit ThornableGumpture
Introduced: 16 Jun 2024
CVE-2024-38460 Open this link in a new tabHow to fix?
Upgrade org.sonarsource.sonarqube:sonar-web to version 9.9.4.87374, 10.4.0.87286 or higher.
Overview
org.sonarsource.sonarqube:sonar-web is an automatic code review tool to detect bugs, vulnerabilities and code smells in your code.
Affected versions of this package are vulnerable to Information Exposure due to the logging of URL parameters. An attacker can access sensitive information by examining web server or proxy logs where encrypted values are inadvertently exposed in cleartext.
References
CVSS Scores
version 3.1