SonarSource SonarQube 7.3 Information Disclosure

2018.11.29
Credit: dubfr33
Risk: Medium
Local: Yes
Remote: No
CWE: N/A

# Exploit Title: SonarSource SonarQube 7.3 - Information Disclosure # Date: 2018-11-21 # Vendor Homepage: https://www.sonarsource.com/ # Software Link: https://www.sonarqube.org/downloads/ # Version: 7.3 and prior # CVE : CVE-2018-19413 # Description: A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system. # Attack Vector: To exploit the vulnerability an authenticated user without administrator permissions sends a specially crafted HTTP GET request to the API causing it to return a list of user information including the externalIdentity field that contains valid usernames used to login to the application. # References: https://jira.sonarsource.com/browse/SONAR-11305 # Credits: Alexander Gonzalez Sent with ProtonMail Secure Email.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top