CVE-2020-27986

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-28 · updated 2026-06-17
Weakness: CWE-306

Description

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.

Affected products

SonarSource SonarQube: 8.4.2.36762

References

https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/
https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/

Get alerted when CVE-2020-27986 or the next vulnerability affects your stack