CVE-2024-53829: Cross-Site Request Forgery in CodeChecker API

January 21, 2025 (updated April 8, 2025)

Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions.

References

github.com/Ericsson/codechecker
github.com/Ericsson/codechecker/security/advisories/GHSA-f8c8-4pm7-w885
github.com/advisories/GHSA-f8c8-4pm7-w885
github.com/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2025-12.yaml
nvd.nist.gov/vuln/detail/CVE-2024-53829

Code Behaviors & Features

Detect and mitigate CVE-2024-53829 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →