CVE-2020-27986: Sonarsource Sonarqube

High severity, CVSS 7.5. EPSS: 16% chance of exploitation in the next 30 days.

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.

Affected products

• Sonarsource Sonarqube: version 8.4.2.36762 only

Published 2020-10-28. Last modified 2026-06-17.