TI-2024-28333 Aliases CVE-2024-42346

Stored Cross Site Scripting (Stored XSS) in Galaxy

LOW 35CWE-79Published 2024-09-20 · Updated 2024-09-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00768 55th percentileScored 2026-11-07

Fix Fixed galaxy (galaxyproject): 24.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
galaxyproject	galaxy	before 24.1.1	24.1.1	Patch available	CNA

galaxy Vendorgalaxyproject Affected before 24.1.1 Fixed in 24.1.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:galaxyproject:galaxy::::::::	before 24.1.1	Vulnerable	galaxyproject

cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:* Versions before 24.1.1 Vulnerable ·galaxyproject

Remediation

Fix · CNA galaxy (galaxyproject) Fixed in 24.1.1

Timeline

2026-10-02 Threatist record created from CVE-2024-42346

References

Patch 1

https://github.com/galaxyproject/galaxy/security/advisories/GHSA-x6w7-3gwf-qr9r

TI-2023-22903 Galaxy vulnerable to Server Side Request Forgery during data imports CVSS 3.1MEDIUM 6.3
TI-2023-12288 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check CVSS 3.1CRITICAL 9.1
TI-2022-07530 Arbitrary file access in the Galaxy data analysis platform CVSS 3.1HIGH 8.6
TI-2015-07990 galaxy-data-resource Command Line Template injection CVSS 3.1CRITICAL 9.8
TI-2024-28338 Possible Data Tampering & Loss of Public Datasets in Galaxy CVSS 3.1CRITICAL 9.1
TI-2018-15916 The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences