p PatchFirst

CVE-2025-54791

CVE-2025-54791 · OMERO.web displays unecessary user information when requesting to reset the password

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • omero-web

    Versions
    • < 5.29.2: Affected

    No fix published

  • omero-web PyPI

    Versions
    • 5.10.0
    • 5.11.0
    • 5.11.0rc1
    • 5.12.0
    • 5.12.1
    • 5.13.0
    • 5.14.0
    • 5.14.0rc1
    • 5.14.1
    • 5.15.0
    • 5.16.0
    • 5.17.0
    • 5.18.0
    • 5.19.0
    • 5.20.0
    • 5.21.0
    • 5.22.0
    • 5.22.1
    • 5.23.0
    • 5.23.1.dev0
    • 5.24.0
    • 5.25.0
    • 5.26.0
    • 5.27.0
    • 5.27.1
    • 5.27.2
    • 5.28.0
    • 5.29.0
    • 5.29.1
    • 5.5.dev1
    • 5.5.dev2
    • 5.6.0
    • 5.6.1
    • 5.6.2
    • 5.6.3
    • 5.6.dev1
    • 5.6.dev2
    • 5.6.dev3
    • 5.6.dev4
    • 5.6.dev5
    • 5.6.dev6
    • 5.6.dev7
    • 5.7.0
    • 5.7.1
    • 5.8.0
    • 5.8.1
    • 5.9.0
    • 5.9.1
    • 5.9.2
    Affected ranges
    • ECOSYSTEM: < 5.29.2

    Update to 5.29.2

Original sources

Check your server →