GHSA-gpmg-4x4g-mr5r
OMERO.web displays unecessary user information when requesting password reset
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Background
If an error occurred when resetting a user's password using the ``Forgot Password`` option in OMERO.web, the error message displayed on the Web page can disclose information about the user.
### Impact
OMERO.web before 5.29.1
### Patches
User should upgrade to 5.29.2 or higher
### Workarounds
Disable the ``Forgot password`` option in OMERO.web using the ``omero.web.show_forgot_password`` configuration property[^1].
Thanks to Christopher Youd who reported the issue.
Open an issue in [omero-web](https://github.com/ome/omero-web)
Email us at [[email protected]](mailto:[email protected])
[^1]: https://omero.readthedocs.io/en/stable/sysadmins/config.html#omero.web.show_forgot_password
References
External links from the advisory. They lead to third-party sites.