CVE-2024-58398

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58398", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-17T12:21:59.408Z", "datePublished": "2026-10-17T18:46:07.073Z", "dateUpdated": "2026-10-21T21:34:59.156Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-17T18:46:07.073Z"}, "datePublic": "2024-10-28T00:00:00.000Z", "title": "Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter", "descriptions": [{"lang": "en", "value": "Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "cweId": "CWE-601", "type": "CWE"}]}], "affected": [{"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.16.0", "status": "affected", "versionType": "semver", "lessThan": "2.16.1"}, {"version": "2.16.1", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.15.0", "status": "affected", "versionType": "semver", "lessThan": "2.15.3"}, {"version": "2.15.3", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.3.1", "status": "affected", "versionType": "semver", "lessThan": "2.14.4"}, {"version": "2.14.4", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.16.0", "versionEndExcluding": "2.16.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.15.0", "versionEndExcluding": "2.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.3.1", "versionEndExcluding": "2.14.4"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.15.0", "versionEndExcluding": "2.15.3"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.3.1", "versionEndExcluding": "2.14.4"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wcx9-ccpj-hx3c)"}, {"url": "https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter"}], "credits": [{"lang": "en", "value": "jchristov", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T21:34:49.806627Z", "id": "CVE-2024-58398", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T21:34:59.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58398", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T21:34:49.806627Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T21:34:55.218Z"}}], "cna": {"title": "Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter", "credits": [{"lang": "en", "type": "reporter", "value": "jchristov"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.16.0", "lessThan": "2.16.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.16.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.15.0", "lessThan": "2.15.3", "versionType": "semver"}, {"status": "unaffected", "version": "2.15.3", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.3.1", "lessThan": "2.14.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.14.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}], "datePublic": "2024-10-28T00:00:00.000Z", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c", "name": "GitHub Security Advisory (GHSA-wcx9-ccpj-hx3c)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter", "name": "VulnCheck Advisory: Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.16.1", "versionStartIncluding": "2.16.0"}, {"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.15.3", "versionStartIncluding": "2.15.0"}, {"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.14.4", "versionStartIncluding": "2.3.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.15.3", "versionStartIncluding": "2.15.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.14.4", "versionStartIncluding": "2.3.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-17T18:46:07.073Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58398", "state": "PUBLISHED", "dateUpdated": "2026-10-21T21:34:59.156Z", "dateReserved": "2026-10-17T12:21:59.408Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-17T18:46:07.073Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.16.1", "status": "affected", "version": "2.16.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.16.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.15.3", "status": "affected", "version": "2.15.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.15.3", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.14.4", "status": "affected", "version": "2.3.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.14.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing."}, {"lang": "es", "value": "Coder 2.3.1, versiones anteriores a 2.14.4; 2.15.x, versiones anteriores a 2.15.3; y 2.16.0, versiones anteriores a 2.16.1, contiene una vulnerabilidad de redirecci\u00f3n abierta en la p\u00e1gina de inicio de sesi\u00f3n porque el par\u00e1metro de consulta redirect no se depura correctamente. Los atacantes pueden crear una URL de inicio de sesi\u00f3n de Coder que, al ser pulsada por un usuario autenticado, redirige a la v\u00edctima a un sitio web controlado por el atacante para phishing."}], "id": "CVE-2024-58398", "lastModified": "2026-11-09T10:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58398", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-21T21:34:49.806627Z", "version": "2.0.3"}}]}, "published": "2026-10-17T19:16:27.860", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.16.0,2.16.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.16.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.15.0,2.15.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.15.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.1,2.14.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.14.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}], "created": "2026-10-17T21:15:15.369980+00:00", "updated": "2026-10-20T18:30:16.818692+00:00", "vendors": ["coder", "coder$PRODUCT$coder"]}