{"cve":"CVE-2024-10082","nvd":{"published":"2024-11-06T15:15:11.760","modified":"2026-06-17T06:54:52.663","status":"Analyzed","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \nAuthentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful.\n\nThis issue affects CodeChecker: through 6.24.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.0},"cwes":["CWE-305","CWE-330","CWE-842"],"references":["https://github.com/Ericsson/codechecker/security/advisories/GHSA-fpm5-2wcj-vfr7"],"products":["ericsson:codechecker"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-10082","score":0.00479,"percentile":0.41352,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fpm5-2wcj-vfr7","url":"https://osv.dev/vulnerability/GHSA-fpm5-2wcj-vfr7","summary":"codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service","modified":"2025-11-15T03:32:00.363355Z","packages":[{"ecosystem":"PyPI","name":"codechecker","purl":"pkg:pypi/codechecker","ranges":["<6.24.2"],"fixed":["6.24.2"]}]},{"id":"PYSEC-2024-183","url":"https://osv.dev/vulnerability/PYSEC-2024-183","summary":"","modified":"2025-01-19T04:56:49.317560Z","packages":[{"ecosystem":"PyPI","name":"codechecker","purl":"pkg:pypi/codechecker","ranges":["<6.24.2"],"fixed":["6.24.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}