Vulnerability · Published Feb 28, 2025 · Assigned by ERIC
CVE-2025-1300Open redirect in CodeChecker web server
Medium 6.1
In plain English
A medium-severity open redirect in CodeChecker from Ericsson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway. This issue affects CodeChecker: through 6.24.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | codechecker | 6.24.6 | GHSA-g839-x3p3-g5fm |
| PyPI | codechecker | 6.24.6 | PYSEC-2026-1259 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ericsson | CodeChecker | 0 – through 6.24.5 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N