CVE-2021-41132

Advisory

Omero-web 5.11.0 includes a fix for CVE-2021-41132: In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of 'jQuery.html()', there are a whole of cross-site scripting possibilities with specially crafted input to a variety of fields.
https://www.openmicroscopy.org/security/advisories/2021-SV3

Affected package

Affected versions

Fixed versions

Vulnerability changelog

---------------------

- Security vulnerability fixes for
[2021-SV3](https://www.openmicroscopy.org/security/advisories/2021-SV3)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41132
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf
• https://www.openmicroscopy.org/security/advisories/2021-SV3/
• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424