Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks. Patches User should upgrade OMERO.web to 5.29.3 or higher. Workarounds None. Resources https://github.com/jquery-form/form/issues/604
Recommended action: Upgrade to 5.29.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background If an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. Impact OMERO.web before 5.29.1 Patches User should upgrade to 5.29.2 or higher Workarounds Disable the Forgot password option in OMERO.web using the omero.web.showforgotpassword configuration property[^1]. Thanks to Christopher Youd who reported the issue. Open an issue in omero-web Email us at security@openmicroscopy.org [^1]: https://omero.readthedocs.io/en/stable/sysadmins/config.html#omero.web.showforgotpassword
Recommended action: Upgrade to 5.29.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is /webclient/imgData/.... As we only really use these endpoints with jQuery's own callback name generation [^1] it is quite difficult or even impossible to exploit this in vanilla OMERO.web. However, these metadata endpoints are likely to be used by many plugins. [^1]: https://learn.jquery.com/ajax/working-with-jsonp/ Impact OMERO.web before 5.25.0 Patches Users should upgrade to 5.26.0 or higher Workarounds None References https://stackoverflow.com/questions/2777021/do-i-need-to-sanitize-the-callback-parameter-from-a-jsonp-call https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names For more information If you have any questions or comments about this advisory: Open an issue in omero-web Email us at security@openmicroscopy.org
Recommended action: Upgrade to 5.26.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
Recommended action: Upgrade to 5.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html(), there are a whole host of XSS possibilities with specially crafted input to a variety of fields. Impact OMERO.web before 5.11.0 and OMERO.figure before 4.4.1. Patches Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.
Recommended action: Upgrade to 5.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirectallowedhosts setting. Impact OMERO.web before 5.9.0 Patches 5.9.0 Workarounds No workaround References For more information If you have any questions or comments about this advisory: Open an issue in omero-web Email us at security
Recommended action: Upgrade to 5.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release. Impact OMERO.web before 5.9.0 Patches 5.9.0 Workarounds No workaround References For more information If you have any questions or comments about this advisory: Open an issue in omero-web Email us at security
Recommended action: Upgrade to 5.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.