Hi, We’ve detected a possible security issue in SonarQube. Repro steps: Go to Administration > Configuration > General Settings. Enter in “About page text” field: aaa[image]bbb [image] Go to about page. JavaScript message is shown. [image] which versions are you using (SonarQube 7.3…

Hi, Thanks for taking the time to report this. In fact, it was identified previously through our own testing procedures, but since only SonarQube administrators can set this property we’ve determined that as a practical matter it’s not a risk. Does this make sense? Ann

Hi Ann, Thank so much for replying. Yeah, it makes sense for me. Regards,

Hi, I fail to see how this is practical as this can be abused by attackers. Also I wonder if there is a (responsible) disclosure workflow as vulnerabilities should not be discussed in the public normally.

Hello, That’s a valid point. We have a responsible disclosure workflow for SonarSource’s customers and we will adapt it to make it available for community users. I will come back to this thread once it is published. Regards

XSS Attack Prevention

SonarQube Server / Community Build

Alexandre_Gigleux (Alexandre Gigleux) May 2, 2019, 7:09am 10

Hello @DanielRuf,

Our Responsible Vulnerability Disclosure policy has been published.

Thanks

Topic		Replies	Views
Trying to use SonarQube to detect XSS vulnerabilities in JS SonarQube Server / Community Build javascript , security , xss	4	3347	August 21, 2023
Does SonarCloud detects XSS in a javascript frontend and a java api.? SonarQube Cloud javascript , java , xss , sonarqube-cloud	3	557	October 19, 2023
Require technical details for SonarQube 7.9.1 LTS (mentioned in Description below) SonarQube Server / Community Build	0	632	November 5, 2020
Not detected XSS Vulnerability Sonarqube SonarQube Server / Community Build sonarqube , xss	3	712	January 26, 2024
Web Browser XSS Protection Not Enabled SonarQube Server / Community Build	1	23	September 8, 2025

XSS Attack Prevention

Related topics