CVE-2022-23470: Arbitrary file access in the Galaxy data analysis platform
First published: Tue Dec 06 2022(Updated: )
Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Galaxyproject Galaxy | >=22.01<=22.05 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-23470?
CVE-2022-23470 is a vulnerability in the Galaxy open-source platform for data analysis that allows for arbitrary file read.
How does CVE-2022-23470 affect Galaxy?
CVE-2022-23470 affects Galaxy versions 22.01 and 22.05, allowing an attacker to read any file accessible to the operating system user under which Galaxy is running.
What is the severity of CVE-2022-23470?
The severity of CVE-2022-23470 is high with a CVSS score of 7.5.
How do I fix CVE-2022-23470?
To fix CVE-2022-23470, it is recommended to update Galaxy to a patched version or apply the necessary security patches provided by Galaxyproject.
Where can I find more information about CVE-2022-23470?
More information about CVE-2022-23470 can be found in the GitHub commit and security advisories provided by Galaxyproject.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/galaxyproject
- canonical/galaxyproject galaxy
- version/galaxyproject galaxy/22.01
- version/galaxyproject galaxy/22.05