GitHub Advisoryadvisory · PyPI

GHSA-6gf2-ffq8-gcww GHSL-2024-288: SickChill open redirect in login

LOW Published 2025-01-08 Modified 2025-01-08 Official page ↗
Aliases
CVE-2024-53995
Ecosystem
PyPI
Packages
sickchill
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P
Weaknesses
CWE-601
Reviewed
2025-01-08

Affected packages

• PyPI sickchill: <= 2024.3.1 (no fix yet)

Description

SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.

Related

Alias · CVE (1)

  • CVE-2024-53995 SickChill is an automatic video library manager for TV shows. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References