p PatchFirst

CVE-2021-21377

CVE-2021-21377 · Open Redirect in OMERO.web

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.

CVSS 4.8 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • omero-web

    Versions
    • < 5.9.0: Affected

    No fix published

  • omero-web PyPI

    Versions
    • 5.5.dev1
    • 5.5.dev2
    • 5.6.0
    • 5.6.1
    • 5.6.2
    • 5.6.3
    • 5.6.dev1
    • 5.6.dev2
    • 5.6.dev3
    • 5.6.dev4
    • 5.6.dev5
    • 5.6.dev6
    • 5.6.dev7
    • 5.7.0
    • 5.7.1
    • 5.8.0
    • 5.8.1
    Affected ranges
    • ECOSYSTEM: < 5.9.0

    Update to 5.9.0

  • omero-web PyPI

    Versions
    • 5.5.dev1
    • 5.5.dev2
    • 5.6.dev1
    • 5.6.dev2
    • 5.6.dev3
    • 5.6.dev4
    • 5.6.dev5
    • 5.6.dev6
    • 5.6.dev7
    • 5.6.0
    • 5.6.1
    • 5.6.2
    • 5.6.3
    • 5.7.0
    • 5.7.1
    • 5.8.0
    • 5.8.1
    Affected ranges
    • GIT: < 952f8e5d28532fbb14fb665982211329d137908c
    • ECOSYSTEM: < 5.9.0

    Update to 5.9.0

Original sources

Check your server →