5.4

CVE-2021-21377

Open Redirect in OMERO.web

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openmicroscopy ≫ Omero.Web Version < 5.9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.526
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.9 6.8 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N
security-advisories@github.com 4.8 1.2 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021
Third Party Advisory
Release Notes
https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c
Patch
Third Party Advisory
https://pypi.org/project/omero-web/
Third Party Advisory
https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmr
Third Party Advisory
https://www.openmicroscopy.org/security/advisories/2021-SV2/
Vendor Advisory