CVE-2023-49793 json
Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
published 2024-06-24 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0028 , GHSA-h26w-r4m5-8rrf , PYSEC-2024-54
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | codechecker | <6.23.0 |
6.23.0 |
Affected products
- Ericsson codechecker
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07a
web, patch
-
github.com
/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrf
web, exploit, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49793
advisory
-
github.com
/Ericsson/codechecker
package
-
github.com
/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2024-54.yaml
web
Sources
- CVE List CVE-2023-49793
- GitHub Advisory GHSA-h26w-r4m5-8rrf
- NVD CVE-2023-49793
- OSV PYSEC-2024-54
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.