PT-2024-29888 · Galaxy · Galaxy

Davelopez · Published 2024-09-20 · Updated 2025-08-15 · CVE-2024-42351

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Galaxy versions prior to release 21.05

Description Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering.

Recommendations For Galaxy versions prior to release 21.05, users are advised to upgrade to a newer version that includes the patch for this issue. At the moment, there is no information about other mitigation measures.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-42351

GHSA-5639-CMPH-9J4V

Affected Products

Galaxy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42351.json · Exploit
• https://github.com/galaxyproject/galaxy/security/advisories/GHSA-5639-cmph-9j4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42351 · Vendor Advisory
• https://depot.galaxyproject.org/patch/GX-2024-0001/235f1d8b400708556732b9dda788c919ebf3bb80.patch · Patch
• https://depot.galaxyproject.org/patch/GX-2024-0001/15060a6cb222f2fcfc687d0f0260f1eb1b9c757b.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42351 · Security Note
• https://depot.galaxyproject.org/patch/GX-2024-0001/022da344a02bafd604402ac8e253e0014f6e2e08.patch · Patch
• https://t.me/cvenotify/95529 · Telegram Post
• https://t.me/cvedetector/6125 · Telegram Post
• https://t.me/cveNotify/132448 · Telegram Post
• https://twitter.com/CVEnew/status/1837208650961564069 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1837234651783438417 · Twitter Post