CVE-2019-9943

HIGH

In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may be circumvented during certain operat...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.8%
Percentile57th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-276: Incorrect Default Permissions

Software sets overly permissive default access rights during installation or resource creation.

Related Attack Patterns (CAPEC)
CAPEC-81 Web Server Logs Tampering
via CWE-276
CAPEC-127 Directory Indexing
via CWE-276
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-276

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in the Open Microscopy Environment OMERO.server versions 5.1.0 through 5.6.0 allows unauthorized users to bypass permissions on OMERO model objects during operations such as move and delete due to mishandled group permissions.

BSID: BS-2020-GLOBAL-142467-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-9943?
A vulnerability in the Open Microscopy Environment OMERO.server versions 5.1.0 through 5.6.0 allows unauthorized users to bypass permissions on OMERO model objects during operations such as move and delete due to mishandled group permissions.
What is the CVSS score for CVE-2019-9943?
CVE-2019-9943 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS: 0.8%.
Is CVE-2019-9943 actively exploited?
No confirmed active exploitation of CVE-2019-9943 as of 2026-05-30.
How do I remediate CVE-2019-9943?
Priority: HIGH. Advisory: https://www.openmicroscopy.org/security/advisories/2019-SV2/ PSIRT: [email protected]
What systems are affected by CVE-2019-9943?
CVE-2019-9943 affects Openmicroscopy Omero.Server.
Vulnerability Details
CVE IDCVE-2019-9943
BSIDBS-2020-GLOBAL-142467-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published2020-06-17
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Incorrect Default Permissions
SourceNVD
Official Description

In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may be circumvented during certain operations such as move and delete, because group permissions are mishandled.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to the OMERO.server could exploit this vulnerability to perform unauthorized actions on objects they should not have permissions to modify, such as moving or deleting objects that belong to other groups or users.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Openmicroscopy Omero.Server ≥ 5.1.0, ≤ 5.6.0
Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2311 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash7e731b8d3515b769ca6dee16e0f26fd830964204a993c3dd0e848a0b06b2ef8d34c12978407ab78bc8c4366cd0ef2f052d23079f6ab4295356af0e9ac74b0fb2
Related CVEs affecting Openmicroscopy
CVE-2019-16244 9.8 OMERO.server before 5.6.1 allows attackers to bypass the security filters and... CVE-2014-7198 8.8 OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework fo... CVE-2017-1000438 8.3 In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its ... CVE-2026-22187 7.8 Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserializ... CVE-2019-9944 7.5 In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading ...
View all Openmicroscopy CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →