XSS in Galette
CVE-2021-21319
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Galette — versions < 0.9.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-21319?
- CVE-2021-21319 is a medium-severity vulnerability in Galette, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2021-10-25.
- How severe is CVE-2021-21319?
- Medium severity. CVSS v3 base score is 6.8 out of 10.