CVE-2024-42346 - CVE House
Back to Database
Status published High CVE-2024-42346

Stored Cross Site Scripting (Stored XSS) in Galaxy

Vulnerability Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42346

Credits & Attribution

No credits recorded in the NVD database.

References

More from galaxyproject

View All →
CVE-2024-42351
Possible Data Tampering & Loss of Public Datasets in Galaxy
Medium 6.5
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data imports
Medium 6.3
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Critical 9.1
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
High 8.6
CVE-2018-1000516
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper...
Medium 6.1

Affected Vendor

galaxyproject

View all reports →

Affected Software

galaxy
Vulnerable Versions:
< 24.1.1

Timeline

Official Publish: September 20th, 2024
Last Modified: September 20th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact