VulnerabilityModified
CVE-2021-21377
These URLs are not validated, allowing redirection to untrusted sites.
MEDIUM 5.4EPSS 0.83%
Does this matter?
Lower severity and a low EPSS score (0.83%). Track it; it rarely justifies an emergency change on its own.
Description
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.83% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- openmicroscopy/omero.web
- Source
- security-advisories@github.com
References
- https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021Release Notes, Third Party Advisory
- https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908cPatch, Third Party Advisory
- https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmrThird Party Advisory
- https://pypi.org/project/omero-web/Third Party Advisory
- https://www.openmicroscopy.org/security/advisories/2021-SV2/Vendor Advisory
- https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021Release Notes, Third Party Advisory
- https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908cPatch, Third Party Advisory
- https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmrThird Party Advisory
- https://pypi.org/project/omero-web/Third Party Advisory
- https://www.openmicroscopy.org/security/advisories/2021-SV2/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.