Back

CVE-2024-47911

Oct. 4, 2024, 9:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

SonarSource SonarQube

  • 10.4
  • 10.5 before 10.6

Source

cve@mitre.org

Tags

cve@mitre.org
2024-10-04
CVE-2024-47911

CVE-2024-47911 details

Published : Oct. 4, 2024, 9:15 p.m.
Last Modified : Oct. 4, 2024, 9:15 p.m.

Description

In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.

CVSS Score

1 2 3 4 5 6.7 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

Base Score

6.7

Exploitability Score

1.2

Impact Score

5.5

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

References

URL Source
https://sonarsource.atlassian.net/browse/SONAR-22340 cve@mitre.org
This website uses the NVD API, but is not approved or certified by it.