Read the docs
TI-2020-06414 Aliases CVE-2020-7932GHSA-vwxv-frj6-fhc9

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to…

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.

Why it matters now

EPSS 0.00803 56th percentileScored 2026-11-07
Fix Fixed omero-web (PyPI): 5.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—omero-web (PyPI)before 5.6.35.6.3Patch availableGHSA-vwxv-frj6-fhc9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • omero-web (PyPI) Vendor— Affected before 5.6.3 Fixed in 5.6.3 Patch available GHSA-vwxv-frj6-fhc9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmicroscopy:omero.web:*:*:*:*:*:*:*:*before 5.6.3Vulnerableome
  • cpe:2.3:a:openmicroscopy:omero.web:*:*:*:*:*:*:*:* Versions before 5.6.3 Vulnerable ·ome

Remediation

  • Fix · GHSA-vwxv-frj6-fhc9 omero-web (PyPI) Fixed in 5.6.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7932
  2. 2026-10-03 Alias added: GHSA-vwxv-frj6-fhc9

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences