Lucene search

GitHub_MCVE-2021-41260

HistoryDec 16, 2021 - 6:15 p.m.

CVE-2021-41260

2021-12-1618:15:08

CWE-352

GitHub_M

web.nvd.nist.gov

galette

web application

membership management

non profit

csrf

vulnerability

security

upgrade

nvd

cve-2021-41260

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.

Affected configurations

Nvd

Vulners

Node

galettegaletteRange<0.9.6

VendorProductVersionCPE
galettegalette*cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
galette	galette	*	cpe:2.3:a:galette:galette::::::::

CNA Affected

[
  {
    "product": "galette",
    "vendor": "galette",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.9.6"
      }
    ]
  }
]

References

github.com/galette/galette/commit/a5602bca2566f1be370631c3ab2d40feedd4b3ad

github.com/galette/galette/security/advisories/GHSA-hw28-c7px-xqm5

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

Related for CVE-2021-41260