Coverity CLI Authentication Bypass

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.

N/A

通过用户控制密钥绕过授权机制

Synopsys Coverity Connect 安全漏洞

Synopsys Coverity Connect是美国新思科技（Synopsys）公司的一个基于 Web 的平台。主要由静态代码分析和动态代码分析工具组成。 Synopsys Coverity Connect存在安全漏洞，该漏洞源于命令行工具的身份验证逻辑缺少错误处理程序，可能导致身份验证绕过。

N/A

N/A