which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension): Sonarqube 8.7 build 41497 problem: lodash 4.17.20 is included in 8.7 but it has discovered CVE-2021-23337. This cause 8.7 has CVE-2021-23337 Requirement: release a fix asap as lodash has release a urgent security…

Hi @RBHuang , as already guessed i can confirm that sonarqube 8.7 is not vulnerable to CVE-2021-23337. while we do ship the version of lodash that is vulnerable to this CVE, it can not be exploited in this context. I can also confirm that lodash is already updated on our current development branch…

CVE-2021-23337 in Sonarqube 8.7

SonarQube Server / Community Build

RBHuang (rb huang) March 18, 2021, 2:52am 5

hi, Tobias, Got it and will follow the principle to properly update security related issue late on.

Topic		Replies	Views
Sonarqube vulnurability CVE-2020 SonarQube Server / Community Build	3	470	August 25, 2021
Dependencies Vulnerabilities Sonarqube Community 9.9 SonarQube Server / Community Build sonarqube	1	308	February 16, 2024
CVE-2022-22970, CVE-2022-22971 Vulnerabilities in SonarQube 8.9 LTS SonarQube Server / Community Build sonarqube , security , spring , cve	1	1434	May 9, 2023
Is there "official" sonarqube documentation that states version 9.9 is NOT impacted by CVE-2022-4288 SonarQube Server / Community Build	5	892	May 24, 2023
Can Sonarqube detect CVE-2021-44228 SonarQube Server / Community Build sonarqube , scanner	0	642	December 13, 2021

CVE-2021-23337 in Sonarqube 8.7

Related topics