CVE-2020-35193

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Affected products

Alpine, Docker, Sonarqube

Sonarsource Sonarqube Docker Image

= 4.5.7, 5.5, 5.6, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.7, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.4, 6.5, 6.6, 6.7, 6.7.1, 6.7.2, 6.7.3, 6.7.4, 6.7.5, 7.0, 7.1, lts

Fix

Available

CVSS 2.0

10.0 HIGH

CVSS 3.1

9.8 CRITICAL

EPSS

2.1% (80th percentile)

Weakness

CWE-306

NVD status

Modified

Published

2020-12-15

No exploit for CVE-2020-35193 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.