CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs
An authentication bypass in CodeChecker allows attackers to gain superuser access and modify products via API endpoints ending in Authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-10081?
CVE-2024-10081 is a critical authentication bypass vulnerability in Ericsson CodeChecker, published on 6 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
Which versions are affected by CVE-2024-10081?
3 open source packages ship an affected version, including codechecker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codechecker PyPI | All versions | 6.24.2 |
codechecker PyPI | All versions | 6.24.2 |
codechecker PyPI | All versions | 6.24.2 |
Products include Ericsson Codechecker.
How do I fix CVE-2024-10081?
Upgrade codechecker to 6.24.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-10081 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10081 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Ericsson CodeChecker
- CVE-2026-25660 Authentication bypass for certain API calls
- CVE-2024-10082 codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service
- CVE-2024-53829 Cross-Site Request Forgery in CodeChecker API
- CVE-2023-49793 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
- CVE-2025-1300 Open redirect in CodeChecker web server
Sources
Also known as GHSA-f3f8-vx3w-hp5q, PYSEC-2024-238.