Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2024-10082

kritik

CVE-2024-10082

codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

Yayın Değişiklik CWE 305, 330, 842
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA9.4CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA.

Açıklama

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
pip::GitHub Security Advisory pipcodechecker6.24.2

Referanslar

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.