CVE-2025-54791CWE-209

OMERO.web displays unecessary user information when requesting to reset the password

Medium · published August 13, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 17.0th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2025-08-13T14:08Z
EPSS history
Timeline
  • 13 AUG 14:08Z
    OMERO.web displays unecessary user information when requesting to reset the password
    cvelistv5