1. Home
  2. CVE Database
  3. CVE-2021-21319
MEDIUM · 6.8

CVE-2021-21319

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscripti...

Vulnerability Description

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
GaletteGalette< 0.9.5

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-21319?

CVE-2021-21319 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscripti...

How severe is CVE-2021-21319?

CVE-2021-21319 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21319?

Check the references section above for vendor advisories and patch information. Affected products include: Galette Galette.