PT-2021-23116

CVE-2021-41132

Published

2021-10-14

Updated

2021-10-20

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OMERO.web versions prior to 5.11.0 OMERO.figure versions prior to 4.4.1

Description The issue arises from a lack of proper sanitization through HTML escaping in various templates, combined with the use of jQuery.html(). This leads to potential cross-site scripting possibilities when specially crafted input is provided to different fields.

Recommendations For OMERO.web versions prior to 5.11.0, upgrade to version 5.11.0 or higher. For OMERO.figure versions prior to 4.4.1, upgrade to version 4.4.1 or higher.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2021-41132

GHSA-G67G-HVC3-XMVF