GitHub Advisoryadvisory · PyPI

GHSA-g67g-hvc3-xmvf Inconsistent input sanitisation leads to XSS vectors

CRITICAL Published 2021-10-14 Modified 2024-10-08 Official page ↗
Aliases
CVE-2021-41132
Ecosystem
PyPI
Packages
omero-web, omero-figure
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-116, CWE-79
Reviewed
2021-10-14

Affected packages

• PyPI omero-web: < 5.11.0 → fixed in 5.11.0 • PyPI omero-figure: < 4.4.1 → fixed in 4.4.1

Description

Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields. Impact OMERO.web before 5.11.0 and OMERO.figure before 4.4.1. Patches Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.

Related

Alias · CVE (1)

  • CVE-2021-41132 OMERO.web provides a web based client and plugin infrastructure. vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References