CVE-2018-1000633

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-20 · updated 2026-06-17
Weakness: CWE-200

Description

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable via an attacker reading the web server log. This vulnerability appears to have been fixed in 5.4.7.

Affected products

Openmicroscopy Omero: before 5.4.7 — fixed in 5.4.7

How to fix

Upgrade to a fixed version: Openmicroscopy Omero 5.4.7. Check the vendor advisory for mitigations.

References

http://www.openmicroscopy.org/2018/07/26/omero-5-4-7.html
http://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/
http://www.openmicroscopy.org/2018/07/26/omero-5-4-7.html
http://www.openmicroscopy.org/security/advisories/2018-SV1-post-password/

Get alerted when CVE-2018-1000633 or the next vulnerability affects your stack