CVE-2024-10082: codechecker — Fix

Description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.

Is your site exposed to CVE-2024-10082?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness Type (CWE)

CWE-305 CWE-305

CWE-330 CWE-330

CWE-842 CWE-842

Affected Products

Vendor	Product	Versions
ericsson	codechecker	< 6.24.2

References

Advisories & Patches

https://github.com/Ericsson/codechecker/security/advisories/GHSA-fpm5-2wcj-vfr7

Frequently Asked Questions

What is CVE-2024-10082? +

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1. It has a CVSS v3.1 base score of 8.7 (HIGH).

How severe is CVE-2024-10082? +

CVE-2024-10082 has a CVSS v3.1 score of 8.7 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-10082? +

CVE-2024-10082 affects products from ericsson, specifically: codechecker. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-10082? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40582

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and …

CVE-2025-53534

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend …

CVE-2025-24522 10.0

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This …

CVE-2024-1403 10.0

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an …

CVE-2024-36388 10.0

MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function

CVE-2024-1202 9.8

Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.This issue affects Octopod: before v1. NOTE: The vendor …

CVE-2024-10082