CVE-2018-19413
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
- Record
CVE-2018-19413- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
- Record
CVE-2018-19413- Updated
- 2026-11-02
EUVDEUVD-2022-4499 No score
A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
- Record
EUVD-2022-4499- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m643-2pfv-xwm8
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
- Record
GHSA-m643-2pfv-xwm8- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-m643-2pfv-xwm8
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
- Record
GHSA-m643-2pfv-xwm8- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.sonarsource.sonarqube:sonar-plugin-apiMaven |
before 7.5 | 7.5 |
org.sonarsource.sonarqube:sonar-plugin-apiMaven |
before 7.5, plus listed versions 5.25.2-RC25.2-RC35.2-RC45.3 Show 45 moreShow less5.3-RC15.3-RC25.45.4-RC15.4-RC25.4-RC35.4-RC45.55.5-RC15.5-RC25.65.6-RC15.6-RC25.6.15.6.25.6.35.6.45.6.55.6.65.6.76.06.0-RC16.0-RC26.16.1-RC16.1-RC26.26.2-RC16.2-RC36.2.16.36.3-RC46.3.16.46.4-RC16.4-RC26.4-RC36.56.5-RC16.5-RC26.66.6-RC16.76.7-RC16.7.1 |
7.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-19413 is a medium vulnerability (CVSS 4.3) in Sonarsource Sonarqube, published December 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in org.sonarsource.sonarqube:sonar-plugin-api 7.5.
References
Left out here: 14 versions. The JSON record has them.