CVE-2021-21377mediumCWE-601

CVE-2021-21377: medium-severity vulnerability in omero-web

Open Redirect in OMERO.web

Published · Updated

Follow this CVE+ Monitor omero-web+ Monitor omero-web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.8%
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
ome · omero-web
Related CVEs — omero-web

In the same product, most dangerous first.

CVE-2021-21376MEDIUMInformation Exposure in OMERO.webEPSS 1.5%CVE-2021-41132CRITICALInconsistent input sanitisation leads to XSS vectorsEPSS 1.0%CVE-2024-35180MEDIUMOMERO.web JSONP callback vulnerabilityEPSS 0.3%CVE-2025-54791MEDIUMOMERO.web displays unecessary user information when requesting to reset the passwordEPSS 0.3%