PT-2024-29883 · Galaxy · Galaxy

Partywavesec · Published 2024-09-20 · Updated 2025-08-15 · CVE-2024-42346

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Galaxy versions prior to the latest patched version

Description The issue concerns the editor visualization, specifically the "/visualizations" endpoint, which can be used to store HTML tags and trigger javascript execution upon an edit operation. Users are advised to upgrade as there are no known workarounds for this issue.

Recommendations For all affected versions of Galaxy, upgrade to the latest version that includes the supplied patches to resolve the issue. As a temporary workaround, consider restricting access to the "/visualizations" endpoint until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-42346

GHSA-X6W7-3GWF-QR9R

PYSEC-2024-272

PYSEC-2024-273

Affected Products

Galaxy

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42346.json · Exploit
• https://github.com/galaxyproject/galaxy/security/advisories/GHSA-x6w7-3gwf-qr9r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-273 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-272 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42346 · Security Note
• https://twitter.com/cracbot/status/1838458445982503169 · Twitter Post
• https://twitter.com/cracbot/status/1838820799236706605 · Twitter Post
• https://t.me/cveNotify/132447 · Telegram Post
• https://t.me/cvenotify/95528 · Telegram Post
• https://t.me/cvedetector/6124 · Telegram Post
• https://twitter.com/CVEnew/status/1837208652320543045 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1837233371191128361 · Twitter Post