6.5
CVE-2024-38460
- EPSS 0.18%
- Veröffentlicht 16.06.2024 15:15:51
- Zuletzt bearbeitet 13.03.2025 15:15:45
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginIn SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonarsource ≫ Sonarqube Version < 9.9.4
Sonarsource ≫ Sonarqube Version >= 10.0.0.68432 < 10.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.18% | 0.4 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| cve@mitre.org | 4.9 | 1.2 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
|
CWE-532 Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.