2018-SV3 Modify User Password

affects OMERO 5 versions 5.4.6 and earlier

back to Advisories

Synopsis

Restricted administrators who are permitted to modify users can change the password of administrators more powerful than themselves then log in using that new password to gain elevated privileges.

Background

Without the ModifyUser restriction an administrator may,

  1. Change another administrator's e-mail address to their own.

  2. Reset that administrator's password.

  3. Read the new password from the e-mail sent by OMERO.server.

  4. Log in as that other administrator.

or,

  1. Change another administrator's password to a given value.

  2. Log in as that other administrator.

This vulnerability is identified as CVE-2018-1000634.

Affected Packages

OMERO.server from 5.4.0 to 5.4.6 inclusive.

Impact

Medium severity.

CVSS score 5.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N/E:F/RL:O/RC:C

Workaround

Do not give restricted administrators such as Group and Data Organizer the ability to Create and Edit Users. This corresponds to the ModifyUser restriction as viewed from OMERO.cli.

Resolution

All OMERO.servers should be upgraded to at least 5.4.7.

back to top