Lucene search

Veracode Vulnerability DatabaseVERACODE:47142

HistoryMay 23, 2024 - 7:49 a.m.

Improper Callback Validation

2024-05-2307:49:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

callback

jsonp

vulnerable

browser

validation

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7.3

Confidence

High

EPSS

Percentile

9.0%

JSON

omero-web is vulnerable to Improper Callback Validation. The vulnerability is due to a lack of sanitization or validation of callback parameters in JSONP-enabled endpoints, which allows an attacker to execute arbitrary JavaScript code in the browser.

References

github.com/advisories/GHSA-vr85-5pwx-c6gq

github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa

github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

7.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for VERACODE:47142