CVE-2024-42346— Stored Cross Site Scripting (Stored XSS) in Galaxy
Quick assessment
Affected
galaxyproject galaxy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Galaxy是Galaxy Project开源的一个 FAIR 数据分析的开源平台。 Galaxy 24.1.1之前版本存在跨站脚本漏洞，该漏洞源于当用户使用编辑器可视化编辑恶意数据集时，攻击者可以诱骗用户执行任意javascript代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-42346
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross Site Scripting (Stored XSS) in Galaxy
Source: CVE Program / CVE List V5
Vulnerability Description
Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Galaxy 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Galaxy是Galaxy Project开源的一个 FAIR 数据分析的开源平台。 Galaxy 24.1.1之前版本存在跨站脚本漏洞，该漏洞源于当用户使用编辑器可视化编辑恶意数据集时，攻击者可以诱骗用户执行任意javascript代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| galaxyproject | galaxy | < 24.1.1 | - |
|
II. Public POCs for CVE-2024-42346
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2024-42346 POC | https://github.com/partywavesec/CVE-2024-42346 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-42346
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-42346 (1)
-
https://github.com/galaxyproject/galaxy/security/advisories/GHSA-x6w7-3gwf-qr9r x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: galaxy
-
CVE-2024-42351
Possible Data Tampering & Loss of Public Datasets in Galaxy -
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data -
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visu -
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
Same vendor: galaxyproject
-
CVE-2024-42351
Possible Data Tampering & Loss of Public Datasets in Galaxy -
CVE-2023-42812
Galaxy vulnerable to Server Side Request Forgery during data -
CVE-2023-27578
Galaxy vulnerable to unauthorized modification of pages/visu -
CVE-2022-23470
Arbitrary file access in the Galaxy data analysis platform
Same weakness: CWE-79
-
CVE-2026-62049
WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross -
CVE-2026-4264
Reflected Cross-Site Scripting in BeeTienda eCommerce platfo -
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server W -
CVE-2026-81929
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8 -
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login pa
V. Comments for CVE-2024-42346
No comments yet