VULNERABILITY INTELLIGENCE

CVE-2024-38460

CVSS score4.9 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2024-06-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Description

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

Weakness classification

nvd@nist.gov: CWE-532
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-532

Primary references

cve@mitre.org — Exploit, Issue Tracking, Vendor Advisory
cve@mitre.org — Issue Tracking
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking