CVE-2017-1000438

EUVD-2017-1569
In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the user's data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.3 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
Affected Products (NVD)
VendorProductVersion
openmicroscopyomero
𝑥
≤ 5.3.3
𝑥
= Vulnerable software versions
References
https://www.openmicroscopy.org/security/advisories/2017-SV5-filename-2/
https://www.openmicroscopy.org/security/advisories/2017-SV5-filename-2/