Description (CNA)
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://sonarsource.atlassian.net/browse/SONAR-21795
- https://sonarsource.atlassian.net/browse/SONAR-21813
- https://community.sonarsource.com/t/sonarqube-github-integration-information-leakage/126609
ADP enrichment
No English description supplied.
No references supplied.