2012-SV1 LDAP Authentication

affects OMERO4 versions 4.3.3 and earlier, and 4.4.3 and earlier

back to Advisories


An LDAP authentication vulnerability has been found in OMERO.server.


When OMERO.server has LDAP authentication enabled and the LDAP server allows anonymous binds the use of an empty ("") password via the OMERO.server API permits logging in as any LDAP-based user.

Affected Packages

OMERO.server between 4.3.0 and 4.3.3 inclusive, and all 4.4 servers prior to 4.4.3


A remote attacker could possibly login to accounts he/she is not permitted to access via the OMERO.server API. Logins via OMERO.insight or OMERO.web are not affected.


Disable LDAP authentication.


All OMERO.servers should be upgraded to at least 4.3.4.


Sebastien Besson for notifying the OME team of this security issue via the ome-devel mailing list.

back to top