Possible Data Tampering & Loss of Public Datasets in Galaxy
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering. All supported branches of Galaxy (and more back to release_21.05) were amended with the below patch. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| galaxyproject | galaxy | before 21.05 | 21.05 | Patch available | CNA |
- galaxy Vendorgalaxyproject Affected before 21.05 Fixed in 21.05 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:* | before 21.05 | Vulnerable | galaxyproject |
- cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:* Versions before 21.05 Vulnerable ·galaxyproject
Remediation
- Fix · CNA galaxy (galaxyproject) Fixed in 21.05
Timeline
- 2026-10-02 Threatist record created from CVE-2024-42351
References
Patch 4
- https://github.com/galaxyproject/galaxy/security/advisories/GHSA-5639-cmph-9j4v
- https://depot.galaxyproject.org/patch/GX-2024-0001/022da344a02bafd604402ac8e253e0014f6e2e08.patch
- https://depot.galaxyproject.org/patch/GX-2024-0001/15060a6cb222f2fcfc687d0f0260f1eb1b9c757b.patch
- https://depot.galaxyproject.org/patch/GX-2024-0001/235f1d8b400708556732b9dda788c919ebf3bb80.patch
More galaxyproject Galaxy vulnerabilities
- TI-2023-22903 Galaxy vulnerable to Server Side Request Forgery during data imports CVSS 3.1MEDIUM 6.3
- TI-2023-12288 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check CVSS 3.1CRITICAL 9.1
- TI-2022-07530 Arbitrary file access in the Galaxy data analysis platform CVSS 3.1HIGH 8.6
- TI-2015-07990 galaxy-data-resource Command Line Template injection CVSS 3.1CRITICAL 9.8
- TI-2024-28333 Stored Cross Site Scripting (Stored XSS) in Galaxy CVSS 3.1HIGH 7.6
- TI-2018-15916 The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of… CVSS 3.0MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences