CVE-2021-21376mediumCWE-200

CVE-2021-21376: medium-severity vulnerability in omero-web

Information Exposure in OMERO.web

Published · Updated

Follow this CVE+ Monitor omero-web+ Monitor omero-web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 1.5%
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
ome · omero-web
Related CVEs — omero-web

In the same product, most dangerous first.

CVE-2021-41132CRITICALInconsistent input sanitisation leads to XSS vectorsEPSS 1.0%CVE-2021-21377MEDIUMOpen Redirect in OMERO.webEPSS 0.8%CVE-2024-35180MEDIUMOMERO.web JSONP callback vulnerabilityEPSS 0.3%CVE-2025-54791MEDIUMOMERO.web displays unecessary user information when requesting to reset the passwordEPSS 0.3%