OMERO.web Password Reset Information Disclosure Vulnerability

A vulnerability in OMERO.web versions prior to 5.29.2 allows for the unintentional disclosure of user information. When an error occurs during the password reset process via the 'Forgot Password' feature, the resulting error message can reveal sensitive details about the user. This issue has been addressed in version 5.29.2. Users can also disable the 'Forgot Password' option by using the 'omero.web.show_forgot_password' configuration property.

Impact

The vulnerability could lead to unauthorized information disclosure, allowing attackers to gain insights about user accounts.

Remediation

Users are advised to upgrade to OMERO.web version 5.29.2 or later. If an immediate upgrade is not possible, the 'Forgot Password' feature can be disabled using the 'omero.web.show_forgot_password' configuration property.