CVE-2018-1000633

Published: Aug 20, 2018Modified: Nov 21, 2024

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable via an attacker reading the web server log. This vulnerability appears to have been fixed in 5.4.7.

Affected (1)

Products: Openmicroscopy: Omero

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openmicroscopy Omero	Before 5.4.7

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.openmicroscopy.org/2018/07/26/omero-5-4-7.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/

Source: cve@mitre.org

Vendor Advisory

http://www.openmicroscopy.org/2018/07/26/omero-5-4-7.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.