GHSA-g839-x3p3-g5fm
Suggest an improvement- Source
- https://github.com/advisories/GHSA-g839-x3p3-g5fm
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-g839-x3p3-g5fm/GHSA-g839-x3p3-g5fm.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-g839-x3p3-g5fm
- Aliases
- Published
- 2025-03-03T19:53:16Z
- Modified
- 2025-03-03T20:04:20.393250Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- CodeChecker open redirect when URL contains multiple slashes after the product name
- Details
-
Summary
CodeChecker versions up to 6.24.5 contain an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL's path segment. This results in bypassing protections against CVE-2021-28861, leading to the same open redirect pathway.
Details
CodeChecker processes GET requests by first rewriting the path segment of the URL, and then passing the rewritten URL to the webserver framework. When trimming the product name from the URL, no sanitization was performed on the remaining URL, which reintroduced the same issue as CVE-2021-28861, leading to the same open redirect pathway using URLs such as
/Default//attacker.com/%2f...Impact
The vulnerability allows an attacker to create a hyperlink that looks like a legitimate CodeChecker URL, but redirects to an attacker-supplied website when clicked.
- Database specific
{ "nvd_published_at": "2025-02-28T13:15:27Z", "github_reviewed_at": "2025-03-03T19:53:16Z", "github_reviewed": true, "severity": "MODERATE", "cwe_ids": [ "CWE-601" ] }- References
Affected packages
PyPI / codechecker
Package
- Name
- codechecker
- View open source insights on deps.dev
- Purl
- pkg:pypi/codechecker
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.24.6