Description
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HoloViz Panel
Default version status: unaffected
1.2.2 to < 1.9.0affected1.9.0unaffected
pkg:pypi/panelReferences
- https://github.com/holoviz/panel/issues/6782 ↗
- https://github.com/holoviz/panel/commit/a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed ↗
- https://github.com/holoviz/panel/blob/v1.8.10/panel/auth.py#L866-L900 ↗
- https://github.com/holoviz/panel ↗
- https://www.vulncheck.com/advisories/holoviz-panel-from-1.2.2-before-1.9.0-open-redirect-via-next-parameter ↗