本ページは sonarsource sonarqube に影響する公開済み CVE（NVD の CPE 経由で関連付け）を列挙します。各行に深刻度指標・概要・公開日が含まれます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-47911 | In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands. | [email protected] | 6.7 | 0.44% | 2024-10-04 | 2025-09-04 |
| CVE-2024-38460 | In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc). | [email protected] | 4.9 | 0.33% | 2024-06-16 | 2025-03-13 |
| CVE-2020-28002 | In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint. | [email protected] | 5.3 | 1.06% | 2020-11-02 | 2024-11-21 |
| CVE-2020-27986 | SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it. | [email protected] | 7.5 | 16.18% | 2020-10-28 | 2024-11-21 |
| CVE-2019-17579 | SonarSource SonarQube before 7.8 has XSS in project links on account/projects. | [email protected] | 6.1 | 0.66% | 2019-10-14 | 2024-11-21 |
| CVE-2018-19413 | A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system. | [email protected] | 4.3 | 1.15% | 2018-12-14 | 2024-11-21 |