SonarSource develops code-quality and security-analysis platforms centered on SonarQube, a widely adopted static-analysis tool deployed across development pipelines, along with related products such as Jenkins plugins and containerized distributions. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code; the exposure concentrates in authentication and information-disclosure weakness classes—including missing authentication for critical functions, cleartext storage of sensitive data, and cross-site scripting—that reflect the web-based and plugin-integration attack surface of an on-premise analysis platform. Defenders should prioritize patching and network segmentation for SonarQube instances, particularly those exposed to untrusted developer networks; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sonarsource over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-27986HIGH SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for S | Oct 28, 2020 | 7.5 | 42 | NO | YES |
CVE-2020-35193CRITICAL The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected vers | Dec 16, 2020 | 9.8 | 30 | NO | NO |
CVE-2018-1000425HIGH An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file sys | Jan 9, 2019 | 7.8 | 24 | NO | NO |
CVE-2013-5676MEDIUM The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPass | Dec 13, 2013 | 4.0 | 22 | NO | YES |
CVE-2024-47911HIGH In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the adm | Oct 4, 2024 | 7.2 | 21 | NO | NO |
CVE-2019-17579MEDIUM SonarSource SonarQube before 7.8 has XSS in project links on account/projects. | Oct 14, 2019 | 6.1 | 21 | NO | NO |
CVE-2024-38460MEDIUM In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the l | Jun 16, 2024 | 6.5 | 19 | NO | NO |
CVE-2018-19413MEDIUM A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web appl | Dec 14, 2018 | 4.3 | 18 | NO | NO |
CVE-2020-28002MEDIUM In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication i | Nov 2, 2020 | 5.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sonarsource.
Media articles that mention a CVE ID that affects a product developed by Sonarsource — matched by CVE ID, not by vendor name.