CVE-2024-38460

Summary

CVE-2024-38460 is a vulnerability affecting SonarQube versions before 10.4 and 9.9.4 LTS. The issue lies in the Settings Encryption feature, which generates encrypted values that are subsequently exposed in cleartext through URL parameters found in logs like the SonarQube Access Logs and Proxy Logs. This exposure could potentially allow unauthorized access to sensitive information. Users are encouraged to upgrade to a patched version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.