CVE-2021-41132

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116 CWE-79

Affected software

Vendor	Product	Versions
ome	omero-web	< 5.11.0

References

https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424Patch, Third Party Advisory
https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvfThird Party Advisory
https://www.openmicroscopy.org/security/advisories/2021-SV3/Vendor Advisory
https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424Patch, Third Party Advisory
https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvfThird Party Advisory
https://www.openmicroscopy.org/security/advisories/2021-SV3/Vendor Advisory

Timeline

Published: Oct 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411337.8Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0,CVE-2021-411345.4nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists wi CVE-2021-411356.5The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus ha CVE-2021-411363.7Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP heade CVE-2021-411378.8Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerabil CVE-2021-411385.3Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a la CVE-2021-411396.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Track CVE-2021-411405.3Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactio CVE-2021-411417.5PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP CVE-2021-411425.4Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site sc CVE-2021-411437.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could e CVE-2021-411448.8OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to exec