CVE-2024-42351 - CVE House
Back to Database
Status published Medium CVE-2024-42351

Possible Data Tampering & Loss of Public Datasets in Galaxy

Vulnerability Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering. All supported branches of Galaxy (and more back to release_21.05) were amended with the below patch. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42351

Credits & Attribution

No credits recorded in the NVD database.

References

More from galaxyproject

View All →
CVE-2024-42346
Stored Cross Site Scripting (Stored XSS) in Galaxy
High 7.6
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data imports
Medium 6.3
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Critical 9.1
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
High 8.6
CVE-2018-1000516
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper...
Medium 6.1

Affected Vendor

galaxyproject

View all reports →

Affected Software

galaxy
Vulnerable Versions:
< 21.05

Timeline

Official Publish: September 20th, 2024
Last Modified: September 20th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration