Medium severity · published Feb 28, 2025
CVE-2025-1300
Open redirect in CodeChecker web server
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway.
This issue affects CodeChecker: through 6.24.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeChecker · Ericsson
through 6.24.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1300
Vendor Advisory
https://github.com/Ericsson/codechecker/security/advisories/GHSA-g839-x3p3-g5fm
More from CodeChecker
10.0
CVE-2024-10081
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
9.8
CVE-2026-25660
Authentication bypass for certain API calls
9.0
CVE-2024-10082
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
8.2
CVE-2024-53829
Cross-Site Request Forgery in CodeChecker API
7.8
CVE-2025-40843
Buffer overflow in CodeChecker log command