SonarSource SonarQube 7.3 Information Disclosure

Credit: dubfr33
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-200

CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

# Exploit Title: SonarSource SonarQube 7.3 - Information Disclosure # Date: 2018-11-21 # Vendor Homepage: # Software Link: # Version: 7.3 and prior # CVE : CVE-2018-19413 # Description: A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system. # Attack Vector: To exploit the vulnerability an authenticated user without administrator permissions sends a specially crafted HTTP GET request to the API causing it to return a list of user information including the externalIdentity field that contains valid usernames used to login to the application. # References: # Credits: Alexander Gonzalez Sent with ProtonMail Secure Email.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019,


Back to Top