CVE-2024-58389

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-58389
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58389.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-58389
Published
2026-10-12T20:55:07Z
Modified
2026-10-15T02:30:44Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
Details

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58389.json"
}
References

Affected packages

Git / github.com/holoviz/panel

Affected ranges

Type
GIT
Repo
https://github.com/holoviz/panel
Events
Introduced
36a1d92921a86803a6028ff7577515f6ba5d83f1
Fixed
99f03fc315d9830cb32be78768b6ba03b0433df2
Fixed
a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.2.2"
        },
        {
            "fixed":  "1.9.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.2.2
v1.2.3
v1.2.3a1
v1.2.3rc1
v1.3.0
v1.3.0a1
v1.3.0a2
v1.3.0a3
v1.3.0a4
v1.3.0a5
v1.3.0a6
v1.3.0a7
v1.3.0a8
v1.3.0a9
v1.3.0b1
v1.3.0b2
v1.3.0rc1
v1.3.0rc2
v1.3.0rc3
v1.3.1
v1.3.1a1
v1.3.1a2
v1.3.1rc1
v1.3.2
v1.3.2a1
v1.3.2rc1
v1.3.2rc2
v1.3.3
v1.3.3rc1
v1.3.4
v1.4.0
v1.4.0a1
v1.4.0a2
v1.4.0a3
v1.4.0b1
v1.4.0b2
v1.4.0b3
v1.4.0rc1
v1.4.0rc2
v1.4.0rc3
v1.4.0rc4
v1.4.0rc5
v1.4.0rc6
v1.4.0rc7
v1.4.1
v1.4.1a1
v1.4.1rc1
v1.4.1rc2
v1.4.2
v1.4.2rc1
v1.4.2rc2
v1.4.3a1
v1.5.0
v1.5.0a1
v1.5.0a2
v1.5.0a3
v1.5.0a5
v1.5.0a6
v1.5.0a7
v1.5.0a8
v1.5.0b1
v1.5.0b2
v1.5.0b3
v1.5.0b4
v1.5.0b5
v1.5.0b6
v1.5.0b7
v1.5.0b8
v1.5.0rc0
v1.5.0rc1
v1.5.0rc2
v1.5.1
v1.5.1a1
v1.5.1a3
v1.5.2
v1.5.2a0
v1.5.3
v1.5.3a1
v1.5.3b1
v1.5.4
v1.5.4a1
v1.5.4a2
v1.5.5
v1.5.5rc1
v1.6.0
v1.6.0b1
v1.6.0rc1
v1.6.1
v1.6.1a1
v1.6.1rc1
v1.6.1rc2
v1.6.2
v1.6.2a1
v1.6.2a2
v1.6.2a3
v1.6.2a4
v1.6.2b1
v1.6.2rc1
v1.6.2rc2
v1.6.2rc3
v1.6.3
v1.6.3a1
v1.6.3a2
v1.6.3rc1
v1.7.0
v1.7.0a1
v1.7.0rc1
v1.7.1
v1.7.1a0
v1.7.1rc0
v1.7.2
v1.7.2a0
v1.7.2rc1
v1.7.3
v1.7.3b1
v1.7.3rc1
v1.8.0
v1.8.0a0
v1.8.0a1
v1.8.0a2
v1.8.0a3
v1.8.0a4
v1.8.0b1
v1.8.0rc1
v1.8.0rc2
v1.8.0rc3
v1.8.1
v1.8.10
v1.8.10a0
v1.8.10a1
v1.8.10rc0
v1.8.11a0
v1.8.1rc0
v1.8.1rc1
v1.8.2
v1.8.2a1
v1.8.2rc1
v1.8.3
v1.8.3a0
v1.8.3rc0
v1.8.4
v1.8.4b0
v1.8.4rc0
v1.8.5
v1.8.5a2
v1.8.5rc0
v1.8.6
v1.8.6rc0
v1.8.7
v1.8.7a0
v1.8.8a0
v1.8.8b0
v1.8.9
v1.8.9a0
v1.8.9a1
v1.8.9rc0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58389.json"