CVE-2024-53995

SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.

• CWE-601

• https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33
• https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82
• https://github.com/SickChill/sickchill/pull/8811
• https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/

Published

Jan 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53989rails-html-sanitizer is responsible for sanitizing HTML frag…6.1
• CVE-2024-5399Openfind Mail2000 does not properly filter parameters of spe…7.2
• CVE-2024-53990The AsyncHttpClient (AHC) library allows Java applications t…9.2
• CVE-2024-53991Discourse is an open source platform for community discussio…5.9
• CVE-2024-53992unzip-bot is a Telegram bot to extract various types of arch…8.8
• CVE-2024-53994Discourse is an open source platform for community discussio…4.3
• CVE-2024-53996Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-53999Mobile Security Framework (MobSF) is a pen-testing, malware …5.4
• CVE-2024-5400Openfind Mail2000 does not properly filter parameters of spe…8.8
• CVE-2024-54000Mobile Security Framework (MobSF) is a pen-testing, malware …7.5
• CVE-2024-54001Kanboard is project management software that focuses on the …5.5
• CVE-2024-54002Dependency-Track is a Component Analysis platform that allow…5.3