CVE-2021-21377CWE-601

Open Redirect in OMERO.web

Medium · published March 23, 2021

CVSS v3.1
4.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00826 · 57.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-03-23T15:25Z
EPSS history
Timeline
  • 23 MAR 15:25Z
    Open Redirect in OMERO.web
    cvelistv5