Security Advisory
CVE-2020-28002
5.3
MEDIUM
Vulnerability Description
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
Published Date
November 2, 2020
Official Source
NIST NVD Advisory