CVE-2021-41261CWE-79

Stored Cross-site Scripting in Galette

High · published December 16, 2021

CVSS v3.1
8.1
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-16T18:10Z
EPSS history
Timeline
  • 16 DEC 18:10Z
    Stored Cross-site Scripting in Galette
    cvelistv5