Back to Database
Status published
Medium
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data imports
Vulnerability Description
Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-42812
Credits & Attribution
No credits recorded in the NVD database.
References
More from galaxyproject
View All →CVE-2024-42351
Possible Data Tampering & Loss of Public Datasets in Galaxy
Medium
6.5
CVE-2024-42346
Stored Cross Site Scripting (Stored XSS) in Galaxy
High
7.6
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Critical
9.1
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
High
8.6
CVE-2018-1000516
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper...
Medium
6.1
Affected Vendor
galaxyproject
View all reports →Affected Software
galaxy
Vulnerable Versions:
< 22.05
Timeline
Official Publish:
September 22nd, 2023
Last Modified:
September 24th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L