Homepage
About Snyk

codechecker@6.17.0 vulnerabilities

CodeChecker is an analyzer tooling, defect database and viewer extension

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the codechecker package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Authentication Bypass by Primary Weakness

codechecker is an analyzer tooling, defect database and viewer extension

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the form of giving the unremovable auto-generated root user superuser privileges by default. An attacker in possession of this username can control everything that can be controlled via the web interface, and can create an account on an enabled external service.

How to fix Authentication Bypass by Primary Weakness?

Upgrade codechecker to version 6.24.2 or higher.

[,6.24.2)
  • C
Authentication Bypass Using an Alternate Path or Channel

codechecker is an analyzer tooling, defect database and viewer extension

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to improperly parsing the endpoint path, which allows bypassing authentication on all but the /Authentication endpoint. An attacker can gain superuser access to these endpoints to query, add, edit, and delete products.

How to fix Authentication Bypass Using an Alternate Path or Channel?

Upgrade codechecker to version 6.24.2 or higher.

[,6.24.2)
  • H
Directory Traversal

codechecker is an analyzer tooling, defect database and viewer extension

Affected versions of this package are vulnerable to Directory Traversal due to improperly sanitized ZIP files, that are uploaded to the server-side endpoint handling a CodeChecker store. An attacker can make the CodeChecker server load and display files from an arbitrary location on the server machine.

Note: If the CodeChecker server is run with authentication enabled (not the default configuration), then the attack requires a valid user account on the CodeChecker server, with the permission to store to a database and view the stored reports.

How to fix Directory Traversal?

Upgrade codechecker to version 6.23.0 or higher.

[,6.23.0)
  • M
Cross-site Scripting (XSS)

codechecker is an analyzer tooling, defect database and viewer extension

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

How to fix Cross-site Scripting (XSS)?

Upgrade codechecker to version 6.18.2 or higher.

[,6.18.2)
Go back to all versions of this package