PT-2020-11368 · Open Microscopy Environment · Omero.Server

Published 2020-06-17 · Updated 2021-07-21 · CVE-2019-9944

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Microscopy Environment OMERO.server versions 5.0.0 through 5.6.0

Description The issue allows the reading of files from imported image filesets to circumvent OMERO permissions restrictions. This occurs because the Bio-Formats feature allows an image file to have embedded pathnames.

Recommendations For versions 5.0.0 through 5.6.0, consider disabling the Bio-Formats feature until a patch is available to prevent the circumvention of OMERO permissions restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-9944

Affected Products

Omero.Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-9944 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9944 · Vendor Advisory
• https://openmicroscopy.org/security/advisories/2019-SV1 · Vendor Advisory
• https://t.me/cibsecurity/12814 · Telegram Post