scout-browser@4.33 vulnerabilities

scout-browser is a Clinical DNA variant visualizer and browser.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') due to absence of sanitization logic of next parameter in /login API endpoint. The attacker can redirect victims to a controlled malicious website attempting to steal sensitive information.

Note: Due to lack of scheme validation, the attacker can attempt to perform HTTPS Downgrade Attack to perform Man-in-the-Middle attack to steal sessions to perform account takeover.

Upgrade scout-browser to version 4.89 or higher.

scout-browser is a Clinical DNA variant visualizer and browser.

Affected versions of this package are vulnerable to Improper Escaping of Output due to the lack of sanitization in the controllers.downloaded_panel_name function. An attacker can inject malicious data inside the file and upload it with filename containing malicious extension, making the victim unknowingly download malicious files, which may lead to the compromise of their devices or data.

Upgrade scout-browser to version 4.89 or higher.

scout-browser is a Clinical DNA variant visualizer and browser.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF). Pypi package scout-browser (GitHub repository clinical-genomics/scout) prior to v4.52 is vulnerable to server-side request forgery. An attacker could make the application perform arbitrary requests to steal cookies, request access to private areas, or lead to cross-site scripting.

Upgrade scout-browser to version 4.52 or higher.

scout-browser is a Clinical DNA variant visualizer and browser.

Affected versions of this package are vulnerable to Directory Traversal due to improper user-input sanitization, via to the send_file call.

Upgrade scout-browser to version 4.52 or higher.