Vulnerability Description
OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openmicroscopy | Omero.Web | < 5.6.3 |
Related Weaknesses (CWE)
References
- https://www.openmicroscopy.org/security/advisories/2019-SV4/Vendor Advisory
- https://www.openmicroscopy.org/security/advisories/2019-SV4/Vendor Advisory
FAQ
What is CVE-2020-7932?
CVE-2020-7932 is a vulnerability with a CVSS score of 5.7 (MEDIUM). OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, t...
How severe is CVE-2020-7932?
CVE-2020-7932 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7932?
Check the references section above for vendor advisories and patch information. Affected products include: Openmicroscopy Omero.Web.