Information Disclosure in SonarQube Before Version 7.4 by SonarSource

CVE-2018-19413

What is CVE-2018-19413?

An information disclosure vulnerability exists in the API of SonarSource SonarQube prior to version 7.4. This flaw allows authenticated users to access sensitive information, including valid user account logins, due to inadequate access control configurations. Specifically, the API erroneously exposes the externalIdentity field to non-administrator users, facilitating potential further attacks on the system. This vulnerability raises significant security concerns as it could enable unauthorized access to critical user data.

References