Description

It's possible to access the SonarQube Console by using the default credentials. The default administrative user name and password for the SonarQube Console is admin and admin respectively. You should change these default credentials.

Remediation

Change the default administrative credentials for SonarQube Console.

References

SonarQube Security

Related Vulnerabilities

Play framework weak secret key

Weak password

Webmail weak password

Tornado weak secret key

Web application default/weak credentials

Severity

High

Classification

CWE-798 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Weak Credentials Default Credentials