CVE-2024-38460

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the…

Medium · published June 16, 2024

CVSS v3.1
4.9
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.0th percentile
Published
2024-06-16T00:00Z
EPSS history
Timeline
  • 16 JUN 00:00Z
    In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the…
    cvelistv5