{"id":"CVE-2021-41132","published":"2021-10-14T15:45:12Z","modified":"2024-08-04T02:59:31Z","title":"Inconsistent input sanitisation leads to XSS vectors","vendor":"ome","product":"omero-web","tier":"tail","description":{"text":"OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01039,"percentile":0.63905,"provenance":"source"},"cwes":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"references":[{"url":"https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424","tags":["x_refsource_MISC"]},{"url":"https://www.openmicroscopy.org/security/advisories/2021-SV3/","tags":["x_refsource_MISC"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":12.78},{"name":"CVSS severity","points":6.86}]},"vendorSlug":"ome","affectedVersions":[{"vendor":"ome","product":"omero-web","versions":["< 5.11.0"]}],"affected":[{"ecosystem":"PyPI","package":"omero-web","vulnerableRanges":["<5.11.0"],"patched":["5.11.0"],"from":["GHSA-g67g-hvc3-xmvf","PYSEC-2021-372"],"provenance":"source"},{"ecosystem":"PyPI","package":"omero-figure","vulnerableRanges":["<4.4.1"],"patched":["4.4.1"],"from":["GHSA-g67g-hvc3-xmvf","PYSEC-2021-379"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0156","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-omero-web-cve-2021-21376","parents":[{"from":"CVE-2021-21377","to":"CVE-2021-41132","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:omero-web","fromFixed":"5.9.0","toFixed":"5.11.0","daysApart":205},{"kind":"same-code","provenance":"machine","files":["omeroweb/webclient/views.py"],"commits":["https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c","https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424"],"basis":"rarely changed file"}]},{"from":"CVE-2021-21376","to":"CVE-2021-41132","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["omeroweb/webclient/views.py"],"commits":["https://github.com/ome/omero-web/commit/952f8e5d28532fbb14fb665982211329d137908c","https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-7932","published":"2020-06-17","fixed":"5.6.3","kev":false},{"cve":"CVE-2021-21376","published":"2021-03-23","fixed":"5.9.0","kev":false},{"cve":"CVE-2021-21377","published":"2021-03-23","fixed":"5.9.0","kev":false},{"cve":"CVE-2021-41132","published":"2021-10-14","fixed":"5.11.0","kev":false},{"cve":"CVE-2024-35180","published":"2024-05-21","fixed":"5.26.0","kev":false},{"cve":"CVE-2025-54791","published":"2025-08-13","fixed":"5.29.2","kev":false}],"package":"PyPI:omero-web"}}