CVE-2024-35180 OMERO.web JSONP callback vulnerability
Attackers can execute arbitrary JavaScript via unvalidated JSONP callbacks in OMERO.web, requiring JSONP to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-35180?
CVE-2024-35180 is a medium-severity cross-site scripting vulnerability in omero-web, published on 21 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.
Weakness: CWE-830
Which versions are affected by CVE-2024-35180?
3 open source packages ship an affected version, including omero-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
omero-web PyPI | All versions | 5.26.0 |
omero-web PyPI | All versions | 5.26.0 |
omero-web PyPI | All versions | 5.26.0 |
Products include Openmicroscopy Omero-Web.
How do I fix CVE-2024-35180?
Upgrade omero-web to 5.26.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-35180 being exploited?
There is no known exploitation of CVE-2024-35180 in the wild and no public exploit code.
Other vulnerabilities in omero-web
Sources
Also known as GHSA-vr85-5pwx-c6gq, PYSEC-2026-1718.