Authentication Bypass in SonarQube by SonarScanner

CVE-2020-28002

What is CVE-2020-28002?

In SonarQube version 8.4.2.36762, a vulnerability exists that allows an external attacker to bypass authentication using the SonarScanner tool. If the -D sonar.login option is passed with an empty value, the system defaults to anonymous authentication. This can lead to unauthorized access, enabling attackers to create and overwrite both public and private projects through the vulnerable /api/ce/submit API endpoint. Organizations using this version of SonarQube should prioritize mitigating this security exposure to protect their project integrity.

References