CVE-2020-7932

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-17 · updated 2026-06-17
Weakness: CWE-200

Description

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.

Affected products

omero-web: before 5.6.3 — fixed in 5.6.3

How to fix

Upgrade to a fixed version: omero-web 5.6.3. Check the vendor advisory for mitigations.

References

https://www.openmicroscopy.org/security/advisories/2019-SV4/
https://www.openmicroscopy.org/security/advisories/2019-SV4/

Get alerted when CVE-2020-7932 or the next vulnerability affects your stack