CVE-2018-1000516 - CVE House
Back to Database
Status published Medium CVE-2018-1000516

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper...

Vulnerability Description

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000516

Credits & Attribution

No credits recorded in the NVD database.

References

More from galaxyproject

View All →
CVE-2024-42351
Possible Data Tampering & Loss of Public Datasets in Galaxy
Medium 6.5
CVE-2024-42346
Stored Cross Site Scripting (Stored XSS) in Galaxy
High 7.6
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data imports
Medium 6.3
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Critical 9.1
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
High 8.6

Affected Vendor

galaxyproject

View all reports →

Affected Software

galaxy
Vulnerable Versions:
14.10

Timeline

Official Publish: June 26th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.