CVE-2021-21377: Open Redirect Vulnerability in omero-web
Summary
CVE-2021-21377: OMERO.web is open source Django-based software for managing microscopy imaging. Affects omero-web across 2 version ranges.
< 5.9.0
< 952f8e5d28532fbb14fb665982211329d137908c
Fixed in 952f8e5d28532fbb14fb665982211329d137908c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OMERO.web is a Django-based open source software used for managing microscopy imaging. It provides functionalities for login and switching group context. The vulnerability in OMERO.web before version 5.9.0 allows redirection to untrusted sites after performing login or switching the group context. This is due to the lack of validation for the provided URLs, which can lead to potential security risks.
Vulnerability Detail
The vulnerability (CVE-2021-21377) in OMERO.web allows attackers to redirect users to malicious websites. By exploiting this vulnerability, an attacker can trick users into visiting a URL that appears legitimate but actually leads to a malicious site. This can result in various consequences, such as phishing attacks, the installation of malware, or the disclosure of sensitive information. OMERO.web 5.9.0 addresses this issue by implementing URL validation before redirection. External URLs are considered invalid unless explicitly specified in the omero.web.redirect_allowed_hosts setting.
How To Fix
Latest published version: 5.33.2 as of 22 Oct 2026
pip install --upgrade "omero-web==5.33.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
952f8e5d28532fbb14fb665982211329d137908c
This is the first release that contains the fix.
pip install --upgrade "omero-web==952f8e5d28532fbb14fb665982211329d137908c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of OMERO.web.
Conclusion
The open redirect vulnerability in OMERO.web (CVE-2021-21377) allows attackers to redirect users to untrusted sites. Upgrading to OMERO.web version 5.9.0 or later is recommended to fix this vulnerability and ensure secure URL redirection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for omero-web →
FAQ
OMERO.web is an open source Django-based software used for managing microscopy imaging.
The vulnerability allows attackers to redirect users to untrusted sites, potentially leading to phishing attacks, malware installation, or the disclosure of sensitive information.
To fix this vulnerability, upgrade to OMERO.web version 5.9.0 or later.
There are no specific workarounds mentioned for this vulnerability. Upgrading to the latest version is the recommended solution.
For more information, you can refer to the OMERO.web advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/omero-web/PYSEC-2021-32.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for omero-web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
