N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j4gv-6x9v-v23g

GHSA-j4gv-6x9v-v23g: OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

Impact

OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.

Patches

User should upgrade OMERO.web to 5.29.3 or higher.

Workarounds

None.

Resources

https://github.com/jquery-form/form/issues/604

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j4gv-6x9v-v23g

GHSA-j4gv-6x9v-v23g:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
omero-web	pip	< 5.29.3	5.29.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability GHSA-j4gv-6x9v-v23g is not in the primary OMERO.web application code but in a bundled third-party JavaScript library, jquery-form. The analysis of the patch commit a3eadf722cfada2b844b97abe65baf5856e77c4f reveals that the fix was to upgrade this library from a vulnerable version (4.3.0) to a patched version (4.3.1-custom).

The core vulnerabilities were identified within the jquery-form library's source code:

Unsanitized HTML Injection: The ajaxSubmit function, when used with a target option, would directly insert the server's response into the DOM using .html(). This allowed for Cross-Site Scripting (XSS) if the response contained malicious HTML. The patch introduces sanitization by processing the response with $.parseHTML and $.text().
eval() in JSON Parsing: The library contained a fallback parseJSON function that used the dangerous eval() function to process JSON strings. This could lead to arbitrary code execution if an attacker could control the server response. The patch removes this eval() call entirely.

Any part of the OMERO.web client that utilizes the jquery-form plugin for handling form submissions was susceptible. During an exploit, a profiler would show calls originating from the application's JavaScript, leading into the ajaxSubmit function of the jquery-form library, where the malicious data would be processed by the vulnerable code paths.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.