MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdmcDItdzVqbS05NTVx

High CVSS: 7.4 EPSS: 0.00424% (0.61405 Percentile) EPSS:

Permalink JSON

OMERO.web exposes some unnecessary session information in the page

Affected Packages	Affected Versions	Fixed Versions
pypi:omero-web PURL: `pkg:pypi/omero-web`	< 5.9.0	5.9.0
13 Dependent packages 24 Dependent repositories 1,888 Downloads last month Affected Version Ranges All affected versions 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.7.0, 5.7.1, 5.8.0, 5.8.1 All unaffected versions 5.9.0, 5.9.1, 5.9.2, 5.10.0, 5.11.0, 5.11.0rc1, 5.12.0, 5.12.1, 5.13.0, 5.14.0, 5.14.0rc1, 5.14.1, 5.15.0, 5.16.0, 5.17.0, 5.18.0, 5.19.0, 5.20.0, 5.21.0, 5.22.0, 5.22.1, 5.23.0, 5.24.0, 5.25.0, 5.26.0, 5.27.0, 5.27.1, 5.27.2, 5.28.0, 5.29.0, 5.29.1, 5.29.2

Background

OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release.

Impact

OMERO.web before 5.9.0

Patches

5.9.0

Workarounds

No workaround

References

For more information

If you have any questions or comments about this advisory:

Open an issue in omero-web
Email us at security

References:

Identifiers

GHSA-gfp2-w5jm-955q

CVE-2021-21376

Risk

Severity

High

CVSS

CVSS Score: 7.4

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS

EPSS Percentage: 0.00424

EPSS Percentile: 0.61405

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/ome/omero-web

Date and time

Published

over 4 years ago

Updated

about 1 year ago

API

JSON

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories