SonarQube Configuration Exfiltration Vulnerability
CVE-2024-47910

Currently unrated

Key Information:

Vendor: SonarSource
Vendor: CVE Published:; 4 October 2024

🔔 Create SonarSource Vulnerability Alert

What is CVE-2024-47910?

An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.

References

https://sonarsource.atlassian.net/browse/SONAR-21795

https://sonarsource.atlassian.net/browse/SONAR-21813

https://community.sonarsource.com/t/sonarqube-github-inte...

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 4, 2024