CVE-2023-49793
CVE-2023-49793 · Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
CVSS 6.5 · Moyenne · EPSS 0,7% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
codechecker
- Versions du logiciel
- < 6.23.0: Concernée
Aucun correctif publié
codechecker PyPI
- Versions du logiciel
- 6.16.0
- 6.16.0a1
- 6.17.0
- 6.18.0
- 6.18.1
- 6.18.2
- 6.19.0
- 6.19.1
- 6.20.0
- 6.20.0rc1
- 6.21.0
- 6.21.0rc1
- 6.22.0
- 6.22.0rc1
- 6.22.1
- 6.22.2
- 6.22.2.post1
- 6.23.0rc2
- Plages de versions concernées
- ECOSYSTEM: < 6.23.0
Mettez à jour vers 6.23.0
codechecker PyPI
- Versions du logiciel
- 6.16.0
- 6.16.0a1
- 6.17.0
- 6.18.0
- 6.18.1
- 6.18.2
- 6.19.0
- 6.19.1
- 6.20.0
- 6.20.0rc1
- 6.21.0
- 6.21.0rc1
- 6.22.0
- 6.22.0rc1
- 6.22.1
- 6.22.2
- 6.22.2.post1
- 6.23.0rc2
- Plages de versions concernées
- GIT: < 46bada41e32f3ba0f6011d5c556b579f6dddf07a
- ECOSYSTEM: < 6.23.0
Mettez à jour vers 6.23.0