GitHub Advisoryadvisory · PyPI

GHSA-gpmg-4x4g-mr5r OMERO.web displays unecessary user information when requesting password reset

MEDIUM Published 2025-08-13 Modified 2025-08-27 Official page ↗
Aliases
CVE-2025-54791
Ecosystem
PyPI
Packages
omero-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2025-08-13

Affected packages

• PyPI omero-web: < 5.29.2 → fixed in 5.29.2

Description

Background If an error occurred when resetting a user's password using the ``Forgot Password`` option in OMERO.web, the error message displayed on the Web page can disclose information about the user. Impact OMERO.web before 5.29.1 Patches User should upgrade to 5.29.2 or higher Workarounds Disable the ``Forgot password`` option in OMERO.web using the ``omero.web.show_forgot_password`` configuration property[^1]. Thanks to Christopher Youd who reported the issue. Open an issue in omero-web Email us at [email protected] [^1]: https://omero.readthedocs.io/en/stable/sysadmins/config.html#omero.web.show_forgot_password

Related

Alias · CVE (1)

  • CVE-2025-54791 OMERO.web provides a web based client and plugin infrastructure. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References