x/vulndb: potential Go vuln in github.com/Ericsson/codechecker: CVE-2024-53829

[GoVulnBot]

Advisory CVE-2024-53829 references a vulnerability in the following Go modules:

Module
github.com/Ericsson/codechecker

Description:
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions, including but not limited to adding, removing or editing products. The attacker needs to know the ID of the available products to modify or delete them. The attacker cannot directly exfiltrate data (view) from CodeChecker, due to being limited to form-based CSRF.

This issue affects CodeChecker: through 6.24.4.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-53829
• WEB: GHSA-f8c8-4pm7-w885

Cross references:

• github.com/Ericsson/codechecker appears in 4 other report(s):
  • data/excluded/GO-2022-0287.yaml (x/vulndb: potential Go vuln in github.com/Ericsson/codechecker: CVE-2021-44217 #287) NOT_GO_CODE
  • data/excluded/GO-2024-2946.yaml (x/vulndb: potential Go vuln in github.com/Ericsson/codechecker: CVE-2023-49793 #2946) NOT_GO_CODE
  • data/excluded/GO-2024-3257.yaml (x/vulndb: potential Go vuln in github.com/Ericsson/codechecker: CVE-2024-10081 #3257) NOT_GO_CODE
  • data/excluded/GO-2024-3258.yaml (x/vulndb: potential Go vuln in github.com/Ericsson/codechecker: CVE-2024-10082 #3258) NOT_GO_CODE

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/Ericsson/codechecker
      vulnerable_at: 6.24.5+incompatible
summary: CVE-2024-53829 in github.com/Ericsson/codechecker
cves:
    - CVE-2024-53829
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-53829
    - web: https://github.com/Ericsson/codechecker/security/advisories/GHSA-f8c8-4pm7-w885
source:
    id: CVE-2024-53829
    created: 2025-01-21T17:01:23.22694182Z
review_status: UNREVIEWED