CVE-2024-53995
published 2025-01-08CVE-2024-53995: SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit…
PriorityP419low1.9CVSS 4.0
AVNACLATNPRLUIAVCNVILVANSCLSILSALEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EXPLOIT
EPSS
0.94%
56.3th percentile
SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sickchill | sickchill | <= 2024.3.1 | — |
| sickchill | sickchill | 0 – 2024.3.1 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
GHSL-2024-288: SickChill open redirect in login
osv·2025-01-08
CVE-2024-53995 [LOW] GHSL-2024-288: SickChill open redirect in login
GHSL-2024-288: SickChill open redirect in login
SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.
GHSA
GHSL-2024-288: SickChill open redirect in login
ghsa·2025-01-08
CVE-2024-53995 [LOW] CWE-601 GHSL-2024-288: SickChill open redirect in login
GHSL-2024-288: SickChill open redirect in login
SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.
No detection rules found.
Nuclei
SickChill - Open Redirect
nuclei·CVSS 1.9
CVE-2024-53995 [LOW] SickChill - Open Redirect
SickChill - Open Redirect
SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.
Template:
id: CVE-2024-53995
info:
name: SickChill - Open Redirect
author: omarkurt
severity: low
description: |
SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.
impact: |
Authenticated attackers can redirect users to malicious sites, potentially leading to phishing or information disclosure.
remediation: |
Update to the version containing c
No writeups or analysis indexed.
https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82https://github.com/SickChill/sickchill/pull/8811https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/
2025-01-08
Published