Inconsistent input sanitisation leads to XSS vectors

TRUNG BÌNH 6.1CVE-2021-41132 · GHSA-g67g-hvc3-xmvf · PYSEC-2021-372 · Công bố 14/10/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-41132 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng omero-figure, omero-web, omero-figure (openmicroscopy).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 64.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.4.1, 5.11.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
omero-figure PyPI	`< 4.4.1`	`4.4.1`
omero-web PyPI	`< 5.11.0`	`5.11.0`
omero-figure openmicroscopy	`< 4.4.1`	`4.4.1`
omero-web openmicroscopy	`< 5.11.0`	`5.11.0`

Mô tả

Background

A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html(), there are a whole host of XSS possibilities with specially crafted input to a variety of fields.

Impact

OMERO.web before 5.11.0 and OMERO.figure before 4.4.1.

Patches

Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.

Mô tả của NVD

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.