Information Exposure Affecting org.sonarsource.sonarqube:sonar-ws package, versions [,9.9.4.87374) [10.0.0.68432,10.4.0.87286)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (20th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSONARSOURCESONARQUBE-7266571
- published 17 Jun 2024
- disclosed 16 Jun 2024
- credit ThornableGumpture
Introduced: 16 Jun 2024
CVE-2024-38460 Open this link in a new tabHow to fix?
Upgrade org.sonarsource.sonarqube:sonar-ws to version 9.9.4.87374, 10.4.0.87286 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure due to the logging of URL parameters. An attacker can access sensitive information by examining web server or proxy logs where encrypted values are inadvertently exposed in cleartext.
References
CVSS Scores
version 3.1