PT-2021-14459 · Omero.Web · Omero.Web

Teng Zheng · Published 2021-03-23 · Updated 2021-03-27 · CVE-2021-21377

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OMERO.web versions prior to 5.9.0

Description OMERO.web is open source Django-based software for managing microscopy imaging. It supports redirection to a given URL after performing login or switching the group context. However, these URLs are not validated in versions prior to 5.9.0, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting, and external URLs are not considered valid unless specified in the omero.web.redirect allowed hosts setting.

Recommendations For versions prior to 5.9.0, update to version 5.9.0 to add URL validation before redirecting. As a temporary workaround, consider specifying valid external URLs in the omero.web.redirect allowed hosts setting to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-21377

GHSA-G4RF-PC26-6HMR

PYSEC-2021-32

Affected Products

Omero.Web

References · 14

• https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c · Patch
• https://osv.dev/vulnerability/PYSEC-2021-32 · Vendor Advisory
• https://openmicroscopy.org/security/advisories/2021-SV2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21377 · Security Note
• https://osv.dev/vulnerability/GHSA-g4rf-pc26-6hmr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21377 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/omero-web/PYSEC-2021-32.yaml · Note
• https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021 · Note
• https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmr · Note
• https://github.com/ome/omero-web · Note
• https://t.me/cibsecurity/25321 · Telegram Post
• https://t.me/cvenotify/11803 · Telegram Post
• https://t.me/cvenotify/12105 · Telegram Post
• https://pypi.org/project/omero-web · Note