GHSA-pc58-q9c8-wh7j: 
Python vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability in OMERO.web may allow a user to create an administrator account when an existing administrator tries to remove that user from their only group.

Background

When an administrator attempts to remove a user from their only group, the action fails with an error message that contains the user's first and last name. Those values are not HTML encoded, so they provide a vector for executing code within the administrator's browser session. Possible actions include creating additional administrator accounts with known usernames and passwords. For a successful exploit, a user must already have an account in OMERO and change their first and last names for the account to the desired malicious code. They also must be member of only a single group and then get an existing administrator to attempt to remove them from that group.

Impact

OMERO.web before 5.33.3

Patches

User should upgrade to 5.33.3 or higher

Workarounds

None Open an issue in omero-web Email us at security@openmicroscopy.org