PT-2021-23116 · Omero.Web+2 · Omero.Web+2

Lachlan Horsey · Published 2021-10-14 · Updated 2021-10-20 · CVE-2021-41132

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OMERO.web versions prior to 5.11.0 OMERO.figure versions prior to 4.4.1

Description The issue arises from a lack of proper sanitization through HTML escaping in various templates, combined with the use of jQuery.html(). This leads to potential cross-site scripting possibilities when specially crafted input is provided to different fields.

Recommendations For OMERO.web versions prior to 5.11.0, upgrade to version 5.11.0 or higher. For OMERO.figure versions prior to 4.4.1, upgrade to version 4.4.1 or higher.

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2021-41132

GHSA-G67G-HVC3-XMVF

PYSEC-2021-372

PYSEC-2021-379

Affected Products

Omero.Figure

Omero.Web

Jquery

References · 12

• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424 · Patch
• https://osv.dev/vulnerability/CVE-2021-41132 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g67g-hvc3-xmvf · Vendor Advisory
• https://openmicroscopy.org/security/advisories/2021-SV3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41132 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-379 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-372 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/omero-web/PYSEC-2021-372.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/omero-figure/PYSEC-2021-379.yaml · Note
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf · Note
• https://github.com/ome/omero-web · Note
• https://t.me/cibsecurity/30580 · Telegram Post