Vulnerability Description
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openmicroscopy | Omero.Web | < 5.9.0 |
Related Weaknesses (CWE)
References
- https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021Release NotesThird Party Advisory
- https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908cPatchThird Party Advisory
- https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmrThird Party Advisory
- https://pypi.org/project/omero-web/Third Party Advisory
- https://www.openmicroscopy.org/security/advisories/2021-SV2/Vendor Advisory
- https://github.com/ome/omero-web/blob/master/CHANGELOG.md#590-march-2021Release NotesThird Party Advisory
- https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908cPatchThird Party Advisory
- https://github.com/ome/omero-web/security/advisories/GHSA-g4rf-pc26-6hmrThird Party Advisory
- https://pypi.org/project/omero-web/Third Party Advisory
- https://www.openmicroscopy.org/security/advisories/2021-SV2/Vendor Advisory
FAQ
What is CVE-2021-21377?
CVE-2021-21377 is a vulnerability with a CVSS score of 4.8 (MEDIUM). OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context...
How severe is CVE-2021-21377?
CVE-2021-21377 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21377?
Check the references section above for vendor advisories and patch information. Affected products include: Openmicroscopy Omero.Web.