CVE-2021-41132PYSEC-2021-379GHSA-G67G-HVC3-XMVFPYSEC-2021-372
Inconsistent input sanitisation leads to XSS vectors
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.11.0, 4.4.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.
Timeline
- CVE published
- Record last updated
Affected versions
- ome omero-web
fixed in 5.11.0
- omero-figurePyPI
fixed in 4.4.1
- omero-webPyPI
fixed in 5.11.0