Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-47910
CVE-2024-47910:
SonarQube vulnerability analysis and mitigation
Overview
A vulnerability was discovered in SonarSource SonarQube before versions 9.9.5 LTA and 10.x before 10.5, identified as CVE-2024-47910. The vulnerability allows a SonarQube user with Administrator role to modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT. The issue was discovered by security researchers at Synacktiv on February 19, 2024, and was fixed in June 2024 (Sonar Community).
Technical details
The vulnerability is related to improper access control (CWE-284) in the GitHub integration configuration. The issue allows administrators to modify the GitHub API URL configuration to potentially exfiltrate pre-signed JWT tokens. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).
Impact
If exploited, this vulnerability could lead to the exposure of sensitive authentication tokens (pre-signed JWT), potentially allowing unauthorized access to integrated GitHub resources. The impact is considered significant for affected systems, though it requires administrator privileges to exploit (Sonar Community).
Mitigation and workarounds
The vulnerability has been fixed in SonarQube versions 9.9.5 LTA and 10.5, released on June 25, 2024. The fix involves forcing administrators to provide a Private Key for verification when modifying the GitHub API URL. Users are strongly advised to upgrade to these versions or later. Additional security patches are available in versions 9.9.6 LTA and 10.6 (Sonar Community).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management