CVE-2023-27578

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-27578

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27578.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-27578

Aliases

GHSA-j8q2-r4g5-f22j

Published

2023-03-20T19:00:58.106Z

Modified

2026-04-10T04:56:43.168781Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check

Details

Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of Visualizations/Pages exists. Due to this issue, an attacker can modify or delete any Galaxy Visualization or Galaxy Page given they know the encoded ID of it. Additionally, they can copy or import any Galaxy Visualization given they know the encoded ID of it. Patches are available for versions 22.01, 22.05, and 23.0. For the changes to take effect, you must restart all Galaxy server processes. There are no supported workarounds.

Database specific

{
    "cwe_ids": [
        "CWE-284",
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27578.json"
}

References

Affected packages

Git / github.com/galaxyproject/galaxy

Affected ranges

Type: GIT
Repo: https://github.com/galaxyproject/galaxy
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9690680ec7256d979b8b11eb7d5f343a691c93f3

Affected versions

galaxy-tool-util-20.*

galaxy-tool-util-20.5.0.dev1

galaxy-tool-util-20.5.0.dev2

v13.*

v13.01

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27578.json"