Cross-Site Request Forgery Vulnerability in CodeChecker by Ericsson

CVE-2024-53829

What is CVE-2024-53829?

A cross-site request forgery vulnerability in CodeChecker allows unauthenticated attackers to compromise user sessions. By hijacking the authentication of a logged-in user, an attacker can interact with the CodeChecker web API, gaining the ability to modify, delete, or manage products without permission. The attacker must be aware of the product IDs to effect these changes. While direct data exfiltration is constrained due to the limitations of form-based CSRF, the potential for unauthorized actions poses a significant security risk.

References