CVE-2024-35180 json
OMERO.web JSONP callback vulnerability
published 2024-05-21 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1815 , GHSA-vr85-5pwx-c6gq , PYSEC-2026-1718
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.
Patch / fix
- pypi omero-web 5.26.0
- openmicroscopy omero-web 5.26.0
- openmicroscopy omero.web 5.26.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | omero-web | <5.26.0 |
5.26.0 |
Affected products
- ome omero-web
Classification
- Weakness
-
- CWE-830 Inclusion of Web Functionality from an Untrusted Source
References
-
github.com
/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa
web, patch
-
github.com
/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-35180
advisory
-
github.com
/ome/omero-web
package
-
pypi.org
/project/omero-web
package
-
github.com
/advisories/GHSA-vr85-5pwx-c6gq
advisory
Sources
- CVE List CVE-2024-35180
- GitHub Advisory GHSA-vr85-5pwx-c6gq
- NVD CVE-2024-35180
- OSV PYSEC-2026-1718
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.