Inconsistent input sanitisation leads to XSS vectors

中 6.1CVE-2021-41132 · GHSA-g67g-hvc3-xmvf · PYSEC-2021-372 · 14/10/2021 公開 · 17/06/2026 更新

要点

CVE-2021-41132 は omero-figure, omero-web, omero-figure (openmicroscopy) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 64.0% より高い）。
対処：4.4.1, 5.11.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
omero-figure PyPI	`< 4.4.1`	`4.4.1`
omero-web PyPI	`< 5.11.0`	`5.11.0`
omero-figure openmicroscopy	`< 4.4.1`	`4.4.1`
omero-web openmicroscopy	`< 5.11.0`	`5.11.0`

概要

Background

A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html(), there are a whole host of XSS possibilities with specially crafted input to a variety of fields.

Impact

OMERO.web before 5.11.0 and OMERO.figure before 4.4.1.

Patches

Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.

NVD の説明

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.