CVE-2020-35193

Опубликовано: 16 дек. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Ссылки

https://github.com/koharin/koharin2/blob/main/CVE-2020-35193
Third Party Advisory
https://github.com/koharin/koharin2/blob/main/CVE-2020-35193
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sonarsource:sonarqube_docker_image:4.5.7:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.5:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.1:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.2:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.3:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.4:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.5:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:5.6.7:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.0:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.1:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.2:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.3:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.3.1:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.4:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.5:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.6:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7.1:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7.2:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7.3:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7.4:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:6.7.5:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:7.0:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:7.1:*:*:*:*:*:*:*

cpe:2.3:a:sonarsource:sonarqube_docker_image:lts:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.02014

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-306

Связанные уязвимости

GHSA-xpp6-cm2v-hmmg

github

больше 3 лет назад