GitHub Advisoryadvisory · PyPI

GHSA-g4rf-pc26-6hmr OMERO webclient does not validate URL redirects on login or switching group.

MEDIUM Published 2021-03-23 Modified 2024-10-08 Official page ↗
Aliases
CVE-2021-21377
Ecosystem
PyPI
Packages
omero-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-601
Reviewed
2021-03-23

Affected packages

• PyPI omero-web: < 5.9.0 → fixed in 5.9.0

Description

Background OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the ``omero.web.redirect_allowed_hosts`` setting. Impact OMERO.web before 5.9.0 Patches 5.9.0 Workarounds No workaround References For more information If you have any questions or comments about this advisory: • Open an issue in omero-web • Email us at security

Related

Alias · CVE (1)

  • CVE-2021-21377 OMERO.web is open source Django-based software for managing microscopy imaging. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References