CVE-2024-10081

The vulnerability (CWE-288, CWE-420) consists in the access control mechanism being bypassed when the request URL ends with the string 'Authentication'. This allows an unauthenticated attacker to circumvent the authorization layer and send requests to all API endpoints except the /Authentication endpoint itself. The error concerns the URL path verification logic, not the network layer, meaning no special network access is required.

The attacker gains superuser privileges to the entire API, enabling the addition, modification, and deletion of products and the execution of other privileged administrative operations. The vulnerability leads to complete compromise of the confidentiality and integrity of data stored in the system.

Apply patches available from the manufacturer in accordance with the references. Details regarding the fixed version are available in the GitHub repository at: https://github.com/Ericsson/codechecker/security/advisories/GHSA-f3f8-vx3w-hp5q. Until the update is applied, it is recommended to restrict network access to the CodeChecker instance only to trusted hosts.

Ericsson CodeChecker in all versions up to and including 6.24.1.