Description
OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf
Patch, Third Party Advisory x_refsource_misc
https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424
Vendor Advisory x_refsource_misc
https://www.openmicroscopy.org/security/advisories/2021-SV3/
Scores
CVSS v3
9.8
EPSS
0.0056
EPSS Percentile
68.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-116
CWE-79
Status
published
Products (4)
openmicroscopy/omero-figure
< 4.4.1
openmicroscopy/omero-web
< 5.11.0
pypi/omero-figure
0 - 4.4.1PyPI
pypi/omero-web
0 - 5.11.0PyPI
Published
Oct 14, 2021
Tracked Since
Feb 18, 2026