CVE-2024-10082 json
codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service
published 2024-11-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-fpm5-2wcj-vfr7 , PYSEC-2024-183 , EUVD-2024-0029
- cvss
- 8.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful.
This issue affects CodeChecker: through 6.24.1.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | codechecker | <6.24.2 |
6.24.2 |
Affected products
- Ericsson CodeChecker
Classification
References
-
github.com
/Ericsson/codechecker/commit/866f3796d01f3158c49b87ccae3e09c0807c1c7b
web
-
github.com
/Ericsson/codechecker/security/advisories/GHSA-fpm5-2wcj-vfr7
vendor-advisory, web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-10082
advisory
-
github.com
/Ericsson/codechecker
package
-
github.com
/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2024-183.yaml
web
Sources
- CVE List CVE-2024-10082
- GitHub Advisory GHSA-fpm5-2wcj-vfr7
- NVD CVE-2024-10082
- OSV PYSEC-2024-183
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.