Log in Start free

Vulnerability · Published Mar 23, 2021 · Assigned by GitHub_M

CVE-2021-21377Open Redirect in OMERO.web

Medium 4.8

In plain English

A medium-severity open redirect in omero-web from ome. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.8%top 42.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIomero-web5.9.0GHSA-g4rf-pc26-6hmr
PyPIomero-web5.9.0PYSEC-2021-32

Affected products (as reported)

VendorProductVersions
ome omero-web < 5.9.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References