CVE-2024-38460
1 advisory.
Maven/org.sonarsource.sonarqube:sonar-web CVE-2024-38460: medium 4.9, EPSS 0.33%
SonarQube logs sensitive information
Action: Upgrade org.sonarsource.sonarqube:sonar-web to 9.9.4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.9.4 | - |
Fixed versions
| 9.9.4 |
Sources
- osv: GHSA-hw2c-8xgw-mf57
- https://nvd.nist.gov/vuln/detail/CVE-2024-38460
- https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01
- https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187
- https://github.com/SonarSource/sonarqube
- https://sonarsource.atlassian.net/browse/SONAR-21559
CVE-2024-38460 · published · modified · JSON