SonarQube Cleartext Credential Exposure Vulnerability

A vulnerability in SonarQube version 8.4.2.36762 allows remote attackers to access cleartext credentials for SMTP, SVN, and GitLab through the api/settings/values endpoint. This issue arises because these credentials are stored in plaintext and can be retrieved without authentication, exposing sensitive information from integrations with other tools in the agile process.

Impact

Exploitation of this vulnerability leads to unauthorized access to cleartext credentials for GitLab, SVN, and SMTP, which could be used to compromise accounts or services associated with these integrations.

Reproduction

The vulnerability can be reproduced by sending a request to the SonarQube server's api/settings/values endpoint. This can be done without authentication, and the response will include the exposed cleartext credentials for GitLab, SVN, and SMTP.