CVE-2018-19413: Exposure of Sensitive Information to an Unauthorized Actor

May 14, 2022 (updated June 28, 2022)

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.

References

packetstormsecurity.com/files/150496/SonarSource-SonarQube-7.3-Information-Disclosure.html
github.com/advisories/GHSA-m643-2pfv-xwm8
jira.sonarsource.com/browse/SONAR-11305
nvd.nist.gov/vuln/detail/CVE-2018-19413

Code Behaviors & Features

Detect and mitigate CVE-2018-19413 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →