From eb791ae3686e629967f5b393ac2ff76c9dede0f3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 8 Jan 2025 22:05:05 +0000
Subject: [PATCH] Publish GHSA-6gf2-ffq8-gcww

---
 .../GHSA-6gf2-ffq8-gcww.json                  | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-6gf2-ffq8-gcww/GHSA-6gf2-ffq8-gcww.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-6gf2-ffq8-gcww/GHSA-6gf2-ffq8-gcww.json b/advisories/github-reviewed/2025/01/GHSA-6gf2-ffq8-gcww/GHSA-6gf2-ffq8-gcww.json
new file mode 100644
index 00000000000..0f84210efe1
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-6gf2-ffq8-gcww/GHSA-6gf2-ffq8-gcww.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6gf2-ffq8-gcww",
+  "modified": "2025-01-08T22:03:58Z",
+  "published": "2025-01-08T22:03:58Z",
+  "aliases": [
+    "CVE-2024-53995"
+  ],
+  "summary": "GHSL-2024-288: SickChill open redirect in login",
+  "details": "SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "sickchill"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "2024.3.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53995"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SickChill/sickchill/pull/8811"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/SickChill/sickchill"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-601"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-08T22:03:58Z",
+    "nvd_published_at": "2025-01-08T21:15:12Z"
+  }
+}
\ No newline at end of file