CVE-2024-42351

MEDIUM

Galaxy < 21.05 - Unauthenticated Data Tampering via Public Dataset Replacement

Title source: llm
STIX 2.1

Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering. All supported branches of Galaxy (and more back to release_21.05) were amended with the below patch. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS v3 6.5
EPSS 0.0045
EPSS Percentile 35.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
galaxyproject/galaxy < 21.05
Published Sep 20, 2024
Tracked Since Feb 18, 2026