CVE-2024-42351 Possible Data Tampering & Loss of Public Datasets in Galaxy

What is CVE-2024-42351?

CVE-2024-42351 is a medium-severity vulnerability in galaxyproject galaxy, published on 20 Sep 2024.

Official description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering. All supported branches of Galaxy (and more back to release_21.05) were amended with the below patch. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2024-42351?

It affects 1 product.

Products include Galaxyproject Galaxy.

How do I fix CVE-2024-42351?

No fix has been published for CVE-2024-42351 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-42351 being exploited?

There is no known exploitation of CVE-2024-42351 in the wild and no public exploit code.

Other vulnerabilities in galaxyproject galaxy

• CVE-2023-27578 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check Critical 9.1
• CVE-2022-23470 Arbitrary file access in the Galaxy data analysis platform High 8.6
• CVE-2024-42346 Stored Cross Site Scripting (Stored XSS) in Galaxy High 7.6
• CVE-2023-42812 Galaxy vulnerable to Server Side Request Forgery during data imports Medium 6.3
• CVE-2018-1000516 Galaxy cross-site scripting (XSS) Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5639-cmph-9j4v.