CVE-2021-41132
Summary
| CVE | CVE-2021-41132 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-10-14 16:15:00 UTC |
|---|
| Updated | 2021-10-20 19:14:00 UTC |
|---|
| Description | OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Fix issues with inconsistency in input sanitisation leading to XSS ve… · ome/omero-web@0168067 · GitHub |
MISC |
github.com |
|
| Inconsistent input sanitization leads to XSS vectors · Advisory · ome/omero-web · GitHub |
CONFIRM |
github.com |
|
| 2021-SV3 XSS vectors | Open Microscopy Environment (OME) |
MISC |
www.openmicroscopy.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980414 Python (pip) Security Update for omero-figure (GHSA-g67g-hvc3-xmvf)
