CVE-2024-42346 — Stored Cross Site Scripting (Stored XSS) in Galaxy
Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualizati…
Published: 2024-09-20 · CVSS: 7.6 · CVSS 3.1
Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7