GHSA-qqr6-vm23-m488

Source

https://github.com/advisories/GHSA-qqr6-vm23-m488

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qqr6-vm23-m488/GHSA-qqr6-vm23-m488.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-qqr6-vm23-m488

Aliases

Published

2022-05-14T03:02:50Z

Modified

2024-11-26T18:15:25Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Galaxy cross-site scripting (XSS)

Details

The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01.

Database specific

{
    "nvd_published_at": "2018-06-26T16:29:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-22T20:15:21Z"
}

References

Affected packages

PyPI / galaxy-app

Package

Name: galaxy-app; View open source insights on deps.dev
Purl: pkg:pypi/galaxy-app

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

14.10.1