CVE-2021-41260CWE-352

Missing CSRF checks in Galette

High · published December 16, 2021

CVSS v3.1
8.2
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00448 · 38.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-12-16T18:10Z
EPSS history
Timeline
  • 16 DEC 18:10Z
    Missing CSRF checks in Galette
    cvelistv5