Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2023-42812

Galaxy vulnerable to Server Side Request Forgery during data imports

Description

Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

galaxyproject galaxy

  • < 22.05affected

References