Lucene search

[email protected]CVE-2020-35193

HistoryDec 16, 2020 - 12:15 a.m.

CVE-2020-35193

2020-12-1600:15:14

CWE-306

[email protected]

web.nvd.nist.gov

cve-2020-35193

sonarqube

docker

security

remote access

root access

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.8%

JSON

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Affected configurations

NVD

Node

sonarsourcesonarqube_docker_imageMatch4.5.7

sonarsourcesonarqube_docker_imageMatch5.5

sonarsourcesonarqube_docker_imageMatch5.6

sonarsourcesonarqube_docker_imageMatch5.6.1

sonarsourcesonarqube_docker_imageMatch5.6.2

sonarsourcesonarqube_docker_imageMatch5.6.3

sonarsourcesonarqube_docker_imageMatch5.6.4

sonarsourcesonarqube_docker_imageMatch5.6.5

sonarsourcesonarqube_docker_imageMatch5.6.7

sonarsourcesonarqube_docker_imageMatch6.0

sonarsourcesonarqube_docker_imageMatch6.1

sonarsourcesonarqube_docker_imageMatch6.2

sonarsourcesonarqube_docker_imageMatch6.3

sonarsourcesonarqube_docker_imageMatch6.3.1

sonarsourcesonarqube_docker_imageMatch6.4

sonarsourcesonarqube_docker_imageMatch6.5

sonarsourcesonarqube_docker_imageMatch6.6

sonarsourcesonarqube_docker_imageMatch6.7

sonarsourcesonarqube_docker_imageMatch6.7.1

sonarsourcesonarqube_docker_imageMatch6.7.2

sonarsourcesonarqube_docker_imageMatch6.7.3

sonarsourcesonarqube_docker_imageMatch6.7.4

sonarsourcesonarqube_docker_imageMatch6.7.5

sonarsourcesonarqube_docker_imageMatch7.0

sonarsourcesonarqube_docker_imageMatch7.1

sonarsourcesonarqube_docker_imageMatchlts

CPENameOperatorVersion
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq4.5.7
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.5
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.1
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.2
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.3
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.4
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.5
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq5.6.7
sonarsource:sonarqube_docker_imagesonarsource sonarqube docker imageeq6.0

CPE	Name	Operator	Version
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	4.5.7
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.5
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.1
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.2
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.3
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.4
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.5
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	5.6.7
sonarsource:sonarqube_docker_image	sonarsource sonarqube docker image	eq	6.0

Rows per page:

1-10 of 261

References

github.com/koharin/koharin2/blob/main/CVE-2020-35193

Social References

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.8%

JSON

Related for CVE-2020-35193

nvd1 prion1 cvelist1 openvas2