CVE-2024-10081: ericsson codechecker

csirt@kutim:~/threat-intel/cve/CVE-2024-10081

CVSS 10.0 · Critical EPSS 39,9%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada ericsson codechecker. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.

Rincian

Terbit di NVD: 6 November 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-420: Unprotected Alternate Channel
EPSS (30 hari): 39,9% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ericsson	codechecker	Semua versi sebelum 6.24.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Ericsson/codechecker/security/advisories/GHSA-f3f8-vx3w-hp5q advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.