CVE-2021-41132

Katalog CVE

CVSS 6.1 · Medium EPSS 1,0%

Kerentanan Improper Encoding or Escaping of Output pada openmicroscopy omero-figure, openmicroscopy omero-web. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Rincian

Terbit di NVD

14 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openmicroscopy.org/security/advisories/2021-SV3/ advisory vendor
• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424 patch · advisory pihak ketiga
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf advisory pihak ketiga