CVE-2024-58389 HoloViz CVE debrief

Who should care

HoloViz Panel administrators and security teams should assess exposure and apply patches or mitigations to prevent open redirect attacks. This includes reviewing and updating HoloViz Panel to version 1.9.0 or later, monitoring for suspicious login link activity, and verifying and adjusting the next_url cookie handling in panel/auth.py. Additionally, they should consider the potential operational impacts, such as the need for verification of login link and

Why it matters

CVE-2024-58389 is a medium-severity open redirect vulnerability in HoloViz Panel versions 1.2.2 to 1.8.10. Administrators and security teams should review and apply patches or mitigations to prevent potential phishing and credential harvesting attacks.

• Potential phishing attacks via open redirects
• Risk of credential harvesting through attacker-controlled sites
• Possible reputation damage from redirecting users to malicious sites
• Need for verification of login link integrity and next_url cookie handling

Technical summary

HoloViz Panel versions 1.2.2 to 1.8.10 contain an open redirect vulnerability due to an unvalidated next query parameter in panel/auth.py. The vulnerability allows remote attackers to redirect users to attacker-controlled external sites after successful login. This could lead to potential phishing attacks via open redirects, risk of credential harvesting through attacker-controlled sites, and possible reputation damage from redirecting users to malicious sites. Administrators and security teams should review and apply patches or mitigations to prevent potential phishing and credential harvesting attacks.

Defensive priority

Medium priority for HoloViz Panel administrators and security teams

Recommended defensive actions

• Review and apply the patch commit from the GitHub repository
• Update HoloViz Panel to version 1.9.0 or later
• Monitor for and restrict suspicious login link activity
• Verify and adjust the next_url cookie handling in panel/auth.py
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the open redirect vulnerability in HoloViz Panel versions 1.2.2 to 1.8.10. The vulnerability is caused by an unvalidated next query parameter in panel/auth.py.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.