CVE-2024-35180

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35180
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa Patch
https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq Vendor Advisory
https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa Patch
https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*
History

29 Sep 2025, 18:01

Type Values Removed Values Added
First Time Openmicroscopy omero-web
Openmicroscopy
CPE cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*
References () https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa - () https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa - Patch
References () https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq - () https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq - Vendor Advisory

21 Nov 2024, 09:19

Type Values Removed Values Added
References () https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa - () https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa -
References () https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq - () https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq -
Summary
  • (es) OMERO.web proporciona una infraestructura de complementos y cliente basada en web. Actualmente no existe ningún escape ni validación del parámetro `callback` que se pueda pasar a varios endpoints de OMERO.web que tengan JSONP habilitado. Esta vulnerabilidad ha sido parcheada en la versión 5.26.0.

21 May 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 13:15

Updated : 2025-09-29 18:01

NVD link : CVE-2024-35180

Mitre link : CVE-2024-35180

CVE.ORG link : CVE-2024-35180

JSON object : View

Products Affected

openmicroscopy

  • omero-web
CWE
CWE-830

Inclusion of Web Functionality from an Untrusted Source