Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-10082 is a high-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Ericsson Codechecker. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0029
Vulnerability Data
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1…
more
is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 5 OS baselines
V6.4.3
Mitigating Controls (NIST 800-53 r5) AI
AC-2 requires documented procedures for establishing and modifying group memberships, directly stopping incorrect group placement during account provisioning.
Requires unique identification and authentication of users, structurally blocking bypass of the mechanism.
Requires unique identification and authentication of non-organizational users, blocking bypass paths.
SC-12 requires proper cryptographic key establishment and management, which structurally mandates use of sufficient randomness for key generation.
Enforces approved authorizations so a bypass weakness cannot be exploited to reach resources.
AC-6 requires that privileges (including those granted via groups) be assigned according to the principle of least privilege, reducing the chance of erroneous group placement.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.
Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.
Policy-driven management, enforcement, and review of authorizations directly addresses incorrect group assignments.
Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. blocks CWE-305
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. blocks CWE-305
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-842
Windows Server 2016 (2 rules)
- V-224964 Only administrators responsible for the domain controller must have Administrator rights on the system. blocks CWE-842
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-842
Windows Server 2019 (2 rules)
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-842
- V-205738 Windows Server 2019 must only allow administrators responsible for the domain controller to have Administrator rights on the system. blocks CWE-842