SonarSource SonarQube 7.3 Information Disclosure Vulnerability

ID 1337DAY-ID-31689
Type zdt
Reporter dubfr33
Modified 2018-11-28T00:00:00


Exploit for multiple platform in category web applications

                                            # Exploit Title: SonarSource SonarQube 7.3 - Information Disclosure
# Vendor Homepage:
# Software Link:
# Version: 7.3 and prior
# CVE : CVE-2018-19413
# Description: A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
# Attack Vector: To exploit the vulnerability an authenticated user without administrator permissions sends a specially crafted HTTP GET request to the API causing it to return a list of user information including the externalIdentity field that contains valid usernames used to login to the application.
# References:
# Credits: Alexander Gonzalez

# [2019-01-12]  #