Vulnerability · Published Mar 23, 2021 · Assigned by GitHub_M
CVE-2021-21376Information Exposure in OMERO.web
Medium 6.4
In plain English
A medium-severity information exposure in omero-web from ome. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | omero-web | 5.9.0 | GHSA-gfp2-w5jm-955q |
| PyPI | omero-web | 5.9.0 | PYSEC-2021-31 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/ome/omero-web/security/advisories/GHSA-gfp2-w5jm-955q x_refsource_CONFIRM
- https://pypi.org/project/omero-web/ x_refsource_MISC
- https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021 x_refsource_MISC
- https://www.openmicroscopy.org/security/advisories/2021-SV1/ x_refsource_MISC
- https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c x_refsource_MISC