{
"id": "GHSA-g67g-hvc3-xmvf",
"aliases": [
"CVE-2021-41132"
],
"details": "### Background\n\nA variety of templates do not perform proper sanitization through HTML escaping.\nDue to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields.\n\n### Impact\n\nOMERO.web before 5.11.0 and OMERO.figure before 4.4.1.\n\n### Patches\nUsers should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.",
"summary": "Inconsistent input sanitisation leads to XSS vectors",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.11.0"
}
]
}
],
"package": {
"name": "omero-web",
"ecosystem": "PyPI"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.1"
}
]
}
],
"package": {
"name": "omero-figure",
"ecosystem": "PyPI"
}
}
],
"modified": "2024-10-08T12:42:26Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"published": "2021-10-14T21:19:23Z",
"references": [
{
"url": "https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41132",
"type": "ADVISORY"
},
{
"url": "https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424",
"type": "WEB"
},
{
"url": "https://github.com/ome/omero-web",
"type": "PACKAGE"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/omero-figure/PYSEC-2021-379.yaml",
"type": "WEB"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/omero-web/PYSEC-2021-372.yaml",
"type": "WEB"
},
{
"url": "https://www.openmicroscopy.org/security/advisories/2021-SV3",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": "2021-10-14T16:15:00Z",
"github_reviewed_at": "2021-10-14T18:50:58Z"
}
}