p PatchFirst

CVE-2024-35180

CVE-2024-35180 · OMERO.web JSONP callback vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

CVSS 6.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • omero-web

    Versions
    • <= 5.25.0: Affected

    No fix published

  • omero-web PyPI

    Versions
    • 5.10.0
    • 5.11.0
    • 5.11.0rc1
    • 5.12.0
    • 5.12.1
    • 5.13.0
    • 5.14.0
    • 5.14.0rc1
    • 5.14.1
    • 5.15.0
    • 5.16.0
    • 5.17.0
    • 5.18.0
    • 5.19.0
    • 5.20.0
    • 5.21.0
    • 5.22.0
    • 5.22.1
    • 5.23.0
    • 5.23.1.dev0
    • 5.24.0
    • 5.25.0
    • 5.5.dev1
    • 5.5.dev2
    • 5.6.0
    • 5.6.1
    • 5.6.2
    • 5.6.3
    • 5.6.dev1
    • 5.6.dev2
    • 5.6.dev3
    • 5.6.dev4
    • 5.6.dev5
    • 5.6.dev6
    • 5.6.dev7
    • 5.7.0
    • 5.7.1
    • 5.8.0
    • 5.8.1
    • 5.9.0
    • 5.9.1
    • 5.9.2
    Affected ranges
    • ECOSYSTEM: < 5.26.0

    Update to 5.26.0

Original sources

Check your server →