In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the user's data.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LOpenmicroscopy Omero
APPOpenmicroscopy≤ 5.3.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Powiązane podatności
CVE-2014-7198HIGH8.8ten sam produkt
OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSR...
CVE-2018-1000633HIGH7.2ten sam produkt
The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log ...
CVE-2018-1000634HIGH7.2ten sam produkt
The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulner...
CVE-2019-16245MEDIUM5.3ten sam produkt
OMERO before 5.6.1 makes the details of each user available to all users.
CVE-2018-1000635MEDIUM6.7ten sam produkt
The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Se...