Ubuntu.comUB:CVE-2021-41261CVE-2021-41261
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
EPSS
Percentile
19.4%
Galette is a membership management web application built for non profit
organizations and released under GPLv3. Versions prior to 0.9.6 are subject
to stored cross site scripting attacks via the preferences footer. The
preference footer can only be altered by a site admin. This issue has been
resolved in the 0.9.6 release and all users are advised to upgrade. There
are no known workarounds.
References
github.com/galette/galette/commit/0d55bc7f420470e0dbca91ebe7899c592905cbc5
github.com/galette/galette/security/advisories/GHSA-28fg-cp22-6c33
launchpad.net/bugs/cve/CVE-2021-41261
nvd.nist.gov/vuln/detail/CVE-2021-41261
security-tracker.debian.org/tracker/CVE-2021-41261
www.cve.org/CVERecord?id=CVE-2021-41261
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
EPSS
Percentile
19.4%