CVE-2023-42812: falha de média gravidade em galaxyproject galaxy
Galaxy vulnerable to Server Side Request Forgery during data imports
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
galaxyproject · galaxyCVEs relacionadas — galaxyproject galaxy
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23470HIGHArbitrary file access in the Galaxy data analysis platformEPSS 0.9%CVE-2024-42346HIGHStored Cross Site Scripting (Stored XSS) in GalaxyEPSS 0.8%CVE-2023-27578CRITICALGalaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission checkEPSS 0.8%CVE-2024-42351MEDIUMPossible Data Tampering & Loss of Public Datasets in GalaxyEPSS 0.5%