CVE-2023-49793— CodeChecker 安全漏洞

Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

对路径名的限制不恰当(路径遍历)

CodeChecker 安全漏洞

Codechecker是一个 Clang Static Analyzer 和 Clang Tidy 的分析工具、缺陷数据库和查看器扩展。 CodeChecker 6.23之前版本存在安全漏洞，该漏洞源于上传到 `CodeChecker store` 服务器端点的 Zip 文件未经过正确清理。

N/A

N/A