Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12d3h2LWZyajYtZmhjOc4AAlCU

OMERO-web Sensitive Data Exposure

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.

Permalink: https://github.com/advisories/GHSA-vwxv-frj6-fhc9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12d3h2LWZyajYtZmhjOc4AAlCU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 10 months ago

CVSS Score: 5.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Identifiers: GHSA-vwxv-frj6-fhc9, CVE-2020-7932
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-7932
• https://www.openmicroscopy.org/security/advisories/2019-SV4/
• https://github.com/advisories/GHSA-vwxv-frj6-fhc9

Blast Radius: 7.9

Affected Packages