CVE-2021-21319

Katalog CVE

CVSS 5.4 · Medium EPSS 0,89%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada galette. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.

Rincian

Terbit di NVD

25 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.galette.eu/issues/1535 permissions required · advisory vendor
• https://github.com/galette/galette/commit/514418da973ae5b84bf97f94bd288a41e8e3f0a6 patch · advisory pihak ketiga
• https://github.com/galette/galette/commit/8f3bdd9f7d0708466e011253064a867ca2b271a5 patch · advisory pihak ketiga
• https://github.com/galette/galette/commit/f54b2570615d38d0302e937079233e52c2d80995 patch · advisory pihak ketiga
• https://github.com/galette/galette/security/advisories/GHSA-vjc9-mj44-x59q advisory pihak ketiga