CVE-2024-38460: 
Java vulnerability analysis and mitigation

A security vulnerability was identified in SonarQube versions before 10.4 and 9.9.4 LTA, where encrypted values generated using the Settings Encryption feature could be exposed in cleartext as part of URL parameters in various logs, including SonarQube Access Logs and Proxy Logs. The vulnerability was initially discovered and reported by a community member in January 2024, and was subsequently patched in June 2024 (Sonar Community).

The vulnerability stems from the implementation of the Settings Encryption feature, where values intended for encryption were passed as URI parameters to the encrypt API endpoint instead of being transmitted in the request body. This implementation flaw resulted in the sensitive data being logged by the webserver and any HTTPS proxies in the deployment chain. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible vulnerability requiring low privileges and no user interaction (NVD).

The vulnerability compromises the security of encrypted values by exposing them in cleartext within system logs, effectively undermining the purpose of the Settings Encryption feature. This exposure could lead to unauthorized access to sensitive configuration data that was intended to be encrypted (Sonar Community).

The vulnerability can be exploited by accessing the system logs where encrypted values are exposed in cleartext. The attack vector is network-accessible and requires low privileges to exploit (NVD).

The vulnerability has been patched in SonarQube versions 10.4 and 9.9.4 LTA. Users are strongly advised to upgrade to these or later versions. As a temporary workaround before upgrading, administrators can implement log clearing procedures after using the encryption feature, though this is not recommended as a long-term solution (Sonar Community).