VDB
CVE-2021-21319
CVE-2021-21319
PUBLISHED
CVSS 5.400000095367432 MEDIUM
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
EPSS 0.89% · 57.1th percentile
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.89%
57.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | galette | 0, 0.8+dfsg-1, 0.8+dfsg-1ubuntu1 |
Timeline
- Oct 25, 2021 CVE Published
- Oct 26, 2021 EPSS Score
- Dec 21, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 16, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Apr 13, 2022 EPSS Score
- Jun 9, 2022 EPSS Score
- Aug 5, 2022 EPSS Score
- Sep 30, 2022 EPSS Score
- Jan 21, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-21319 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-21319 third-party-advisory