{"action":"Upgrade org.sonarsource.sonarqube:sonar-web to 9.9.4 or later.","affected":[{"fixed":"9.9.4","introduced":"0"}],"component":"org.sonarsource.sonarqube:sonar-web","cve_ids":["CVE-2024-38460"],"ecosystem":"Maven","epss":0.00331,"exploited":false,"fixed_versions":["9.9.4"],"ghsa_id":"GHSA-hw2c-8xgw-mf57","id":"tcs_01M5N91EFF1FHRCYKC96G66GP4","modified_at":"2024-06-25T02:33:30.974481Z","published_at":"2024-06-16T15:30:44Z","references":["https://osv.dev/vulnerability/GHSA-hw2c-8xgw-mf57","https://nvd.nist.gov/vuln/detail/CVE-2024-38460","https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01","https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187","https://github.com/SonarSource/sonarqube","https://sonarsource.atlassian.net/browse/SONAR-21559"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-hw2c-8xgw-mf57","url":"https://osv.dev/vulnerability/GHSA-hw2c-8xgw-mf57"}],"summary":"SonarQube logs sensitive information"}