VulnerabilityModified
CVE-2021-41261
Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer.
MEDIUM 4.8EPSS 0.59%
Does this matter?
Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.
Description
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- galette/galette
- Source
- security-advisories@github.com
References
- https://github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5Patch, Third Party Advisory
- https://github.com/galette/galette/security/advisories/GHSA-28fg-cp22-6c33Third Party Advisory
- https://github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5Patch, Third Party Advisory
- https://github.com/galette/galette/security/advisories/GHSA-28fg-cp22-6c33Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.