CVE-2024-41668

The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery (SSRF) attack. Logged in users could do the same on private instances. A fix has been released in version 6.0.12. As a workaround, one might be able to disable `/proxy` endpoint entirely via, for example, nginx.

• CWE-918

• https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5
• https://github.com/cBioPortal/cbioportal/pull/10884
• https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12
• https://github.com/cBioPortal/cbioportal/security/advisories/GHSA-9h44-r3c3-q7rm
• https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-004
• https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5
• https://github.com/cBioPortal/cbioportal/pull/10884
• https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12
• https://github.com/cBioPortal/cbioportal/security/advisories/GHSA-9h44-r3c3-q7rm
• https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-004

Published

Jul 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41662VNote is a note-taking platform. A Cross-Site Scripting (XSS…9.6
• CVE-2024-41663Canarytokens help track activity and actions on a network. …3.5
• CVE-2024-41664Canarytokens help track activity and actions on a network. P…5.4
• CVE-2024-41665Ampache, a web based audio/video streaming application and f…5.4
• CVE-2024-41666Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2024-41667OpenAM is an open access management solution. In versions 15…8.8
• CVE-2024-4167A vulnerability was found in Tenda 4G300 1.01.42 and classif…8.8
• CVE-2024-41670In the module "PayPal Official" for PrestaShop 7+ releases p…7.5
• CVE-2024-41671Twisted is an event-based framework for internet application…8.3
• CVE-2024-41672DuckDB is a SQL database management system. In versions 1.0.…7.5
• CVE-2024-41673Decidim is a participatory democracy framework. The version …7.1
• CVE-2024-41674CKAN is an open-source data management system for powering d…5.3