CVE-2020-7932
Last modified
CVE-2020-7932 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. EPSS estimates a 0.80% chance of exploitation in the next 30 days.
Description
OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openmicroscopy | Omero.Web | < 5.6.3 |
References
- https://www.openmicroscopy.org/security/advisories/2019-SV4/Vendor Advisory
- https://www.openmicroscopy.org/security/advisories/2019-SV4/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-7932?
How severe is CVE-2020-7932?
How do I fix CVE-2020-7932?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-7925Incorrect validation of user input in the role name parser m…7.5
- CVE-2020-7926A user authorized to perform database queries may cause deni…6.5
- CVE-2020-7927Specially crafted API calls may allow an authenticated user …6.5
- CVE-2020-7928A user authorized to perform database queries may trigger a …6.5
- CVE-2020-7929A user authorized to perform database queries may trigger de…6.5
- CVE-2020-7931In JFrog Artifactory 5.x and 6.x, insecure FreeMarker templa…8.8
- CVE-2020-7934In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name…5.4
- CVE-2020-7935Artica Pandora FMS through 7.42 is vulnerable to remote PHP …7.2
- CVE-2020-7936An open redirect on the login form (and possibly other place…6.1
- CVE-2020-7937An XSS issue in the title field in Plone 5.0 through 5.2.1 a…5.4
- CVE-2020-7938plone.restapi in Plone 5.2.0 through 5.2.1 allows users with…8.8
- CVE-2020-7939SQL Injection in DTML or in connection objects in Plone 4.0 …8.8
Are you affected by CVE-2020-7932?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST