SonarQube vulnerabilities

2 known vulnerabilities in SonarQube from SonarSource. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  sonarqube: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-47911Oct 4, 2024SonarSource

  In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.

• 7.2 High severity

  sonarqube: Improper Access Control

  CVE-2024-47910Oct 4, 2024SonarSource

  An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.