UpHeron
All vulnerabilities

Servers and applications

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.

Severity
High 7.5
Published
28 Oct 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
SonarQube ServerServers and applications · cpe:a:sonarsource:sonarqube
  • Version 8.4.2.36762

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-27986
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-27986