CVE-2024-10081 in the critical feed json
codechecker vulnerable to authentication bypass when using specifically crafted URLs
published 2024-11-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-f3f8-vx3w-hp5q , PYSEC-2024-238 , EUVD-2024-3242
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 39.9%
- EPSS 39.9% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
39.92% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template CodeChecker <= 6.24.1 - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | codechecker | <6.24.2 |
6.24.2 |
Affected products
- Ericsson CodeChecker
Classification
References
-
github.com
/Ericsson/codechecker/commit/ad41702e3108e4b92ae5d0143a5b961cc34195eb
web
-
github.com
/Ericsson/codechecker/security/advisories/GHSA-f3f8-vx3w-hp5q
vendor-advisory, web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-10081
advisory
-
github.com
/Ericsson/codechecker
package
-
github.com
/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2024-238.yaml
web
Sources
- CVE List CVE-2024-10081
- GitHub Advisory GHSA-f3f8-vx3w-hp5q
- NVD CVE-2024-10081
- OSV PYSEC-2024-238
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.