CVE-2018-19413 - CVE House
Back to Database
Status published Medium CVE-2018-19413

A vulnerability in the API of SonarSource SonarQube before 7.4...

Vulnerability Description

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19413

Credits & Attribution

No credits recorded in the NVD database.

References

More from sonarsource

View All →
CVE-2020-35193
The official sonarqube docker images before alpine (Alpine specific) contain...
Critical 9.8
CVE-2020-28002
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass...
Medium 5.3
CVE-2020-27986
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN,...
Unknown 0
CVE-2019-17579
SonarSource SonarQube before 7.8 has XSS in project links on...
Medium 6.1
CVE-2018-1000425
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner...
High 7.8

Affected Vendor

sonarsource

View all reports →

Affected Software

sonarqube
Vulnerable Versions:
0

Timeline

Official Publish: December 14th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.