CVE-2020-37020
Published: 29 January 2026
Summary
CVE-2020-37020 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Sonarqube (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37020 is an unquoted service path vulnerability (CWE-428) in SonarQube 8.3.1. The issue stems from an unquoted service executable path involving wrapper.exe, which allows local attackers to gain SYSTEM privileges by exploiting the path during service operations.
A local attacker with low privileges (PR:L) can exploit this vulnerability by replacing the legitimate wrapper.exe in the service path with a malicious executable. Upon service restart, the malicious code executes with the highest system privileges, resulting in high impacts on confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/sonarqube-unquoted-service-path and the SonarQube site at https://www.sonarqube.org, provide further details on the vulnerability. A public exploit is available at https://www.exploit-db.com/exploits/48677.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30923
Vulnerability details
SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the service executable path. Attackers can replace the wrapper.exe in the service path with a malicious executable to execute code with highest…
more
system privileges during service restart.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path (T1574.009) for local privilege escalation to SYSTEM (T1068) via malicious executable replacement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification, reporting, and correction of flaws like the unquoted service path vulnerability in SonarQube through timely patching or reconfiguration.
Requires secure configuration settings for system components, including quoting service executable paths to eliminate the unquoted path vulnerability.
Monitors software integrity to detect unauthorized alterations or replacements of critical executables like wrapper.exe exploited in this vulnerability.