CVE-2018-19413

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-14 · updated 2026-06-17
Weakness: CWE-200

Description

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.

Affected products

SonarSource SonarQube: before 7.4 — fixed in 7.4

How to fix

Upgrade to a fixed version: SonarSource SonarQube 7.4. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/150496/SonarSource-SonarQube-7.3-Information-Disclosure.html
https://jira.sonarsource.com/browse/SONAR-11305
http://packetstormsecurity.com/files/150496/SonarSource-SonarQube-7.3-Information-Disclosure.html
https://jira.sonarsource.com/browse/SONAR-11305

Get alerted when CVE-2018-19413 or the next vulnerability affects your stack