CVE-2015-10062

galaxy-data-resource Command Line Template injection

State: Published
Severity: 5.5 Medium
Published: Jan 17, 2023
Updated: Aug 6, 2024
Reserved: Jan 16, 2023

Description

A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The manipulation leads to injection. Upgrading to version 14.10.1 is able to address this issue. The patch is named 50d65f45d3f5be5d1fbff2e45ac5cec075f07d42. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218451.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-74 Injection

Affected Products

Product	Versions
galaxy-data-resourcen/a	14.0Affected 14.1Affected 14.2Affected 14.3Affected 14.4Affected 14.5Affected 14.6Affected 14.7Affected 14.8Affected 14.9Affected 14.10Affected

References

https://vuldb.com/?id.218451vdb-entrytechnical-description
https://vuldb.com/?ctiid.218451signaturepermissions-required
https://github.com/blankenberg/galaxy-data-resource/commit/50d65f45d3f5be5d1fbff2e45ac5cec075f07d42patch
https://github.com/blankenberg/galaxy-data-resource/releases/tag/v14.10.1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.