CVE-2021-21376CWE-200

Information Exposure in OMERO.web

Medium · published March 23, 2021

CVSS v3.1
6.4
EPSS
1%
Percentile
73.3
In the wild
Unconfirmed
What it is

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01457 · 73.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-03-23T15:25Z
EPSS history
Timeline
  • 23 MAR 15:25Z
    Information Exposure in OMERO.web
    cvelistv5