CVE-2025-1300 — Open Redirect in Codechecker

CWE-601 — Open Redirect4 documents4 sources
Severity
6.1MEDIUMNVD
CNA7.4GHSA7.4OSV7.4
EPSS
0.1%
top 68.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ericsson Codechecker
Timeline
PublishedFeb 28
Latest updateMar 3

Description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway. This issue affects CodeChecker: through 6.24.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDericsson/codechecker< 6.24.6
▶PyPIericsson/codechecker< 6.24.6
▶CVEListV5ericsson/codechecker6.24.5

🔴Vulnerability Details

3
GHSA
CodeChecker open redirect when URL contains multiple slashes after the product name↗2025-03-03
▶
OSV
CodeChecker open redirect when URL contains multiple slashes after the product name↗2025-03-03
▶
CVEList
Open redirect in CodeChecker web server↗2025-02-28
▶
CVE-2025-1300 — Open Redirect in Ericsson Codechecker | cvebase