SonarSource SonarQube 8.4.2.36762
Approved changes feed: RSS · Atom
cpe:2.3:a:sonarsource:sonarqube:8.4.2.36762:*:*:*:*:*:*:*
part: a version: 8.4.2.36762 update: *
| Vendor | Sonarsource (f7d0a8ac-8677-5a8e-a8b9-6fda255c092c) |
|---|---|
| Product | Sonarqube (bd2dd22d-6ce1-585e-931c-5f7dc99ad07b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/sonarqube |
purl2cpe | 2026-06-01 10:11:32.427551 |
pkg:github/sonarsource/sonarqube |
purl2cpe | 2026-06-01 10:11:32.427553 |
pkg:maven/org.sonarsource.sonarqube/sonarqube |
purl2cpe | 2026-06-01 10:11:32.427554 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-28002 |
vulnerable | 2026-06-08 05:23:53.649759 |
Details available
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
Published: 2020-10-30T02:06:43.000Z
Updated: 2024-08-04T16:25:43.994Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-27986 |
vulnerable | 2026-06-08 05:23:53.626399 |
Details available
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
Published: 2020-10-28T22:57:20.000Z
Updated: 2024-08-04T16:25:43.905Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.