漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
Vulnerability Description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
CodeChecker 安全漏洞
Vulnerability Description
Codechecker是一个 Clang Static Analyzer 和 Clang Tidy 的分析工具、缺陷数据库和查看器扩展。 CodeChecker 6.23之前版本存在安全漏洞，该漏洞源于上传到 `CodeChecker store` 服务器端点的 Zip 文件未经过正确清理。
CVSS Information
N/A
Vulnerability Type
N/A