Cross-site Scripting in Ericsson CodeChecker

MEDIUM 6.1CVE-2021-44217 · GHSA-fxmx-pfm2-85m2 · PYSEC-2022-43181 · Published 18/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
codechecker PyPI	`< 6.18.2`	`6.18.2`
codechecker ericsson	`≤ 6.18.0`	No fix yet

Description

In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

NVD description

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

References

nvd.nist.gov/vuln/detail/CVE-2021-44217 · ADVISORY
Ericsson/codechecker#3549 · WEB
Ericsson/codechecker commit 72ee511 · WEB
codechecker-demo.eastus.cloudapp.azure.com · WEB
Ericsson/codechecker · PACKAGE
Ericsson/codechecker release · WEB
Ericsson/codechecker release v6.18.2 · WEB
Hyperkopite/CVE-2021-44217 · WEB
pypa/advisory-database · WEB
user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.png · WEB
codechecker-demo.eastus.cloudapp.azure.com · Permissions Required
pypi.org/project/codechecker · PACKAGE
GitHub Advisory GHSA-fxmx-pfm2-85m2 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free