CVE-2024-10081

Nov. 6, 2024, 6:17 p.m.

10.0
Critical

Description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.

Product(s) Impacted

Product Versions
CodeChecker
  • ['through 6.24.1']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References

https://github.com/Ericsson/codechecker/security/advisories/GHSA-f3f8-vx3w-hp5q

Tags

CWE-288
85b1779b-6ecd-4f52-bcc5-73eac4659dcf
2024-11-06
CVE-2024-10081

CVSS Score

10.0 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

    View Vector String

Timeline

Published: Nov. 6, 2024, 3:15 p.m.
Last Modified: Nov. 6, 2024, 6:17 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

85b1779b-6ecd-4f52-bcc5-73eac4659dcf

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.