Ericsson CodeChecker up to 6.24.1 authentication bypass

Summaryinfo

A vulnerability has been found in Ericsson CodeChecker up to 6.24.1 and classified as critical. Impacted is an unknown function. This manipulation causes authentication bypass. This vulnerability is handled as CVE-2024-10082. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Ericsson CodeChecker up to 6.24.1. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a authentication bypass vulnerability. The CWE definition for the vulnerability is CWE-305. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-10082 since 10/17/2024. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-0029). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Ericsson

Name

• CodeChecker

Version

• 6.24.0
• 6.24.1

Website

• Product: https://github.com/Ericsson/codechecker/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion