PT-2021-14416 · Galette · Galette

Kkimonk · Published 2021-10-25 · Updated 2021-10-28 · CVE-2021-21319

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Galette versions prior to 0.9.5

Description Galette is a membership management web application geared towards non-profit organizations. In affected versions, malicious javascript code can be stored to be displayed later on the self-subscription page. Additionally, malicious javascript code can be executed on login and retrieve password pages.

Recommendations For versions prior to 0.9.5, update to version 0.9.5 to resolve the issue. As a temporary workaround, consider disabling the self-subscription feature, which is the default state.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21319

GHSA-VJC9-MJ44-X59Q

Affected Products

Galette

References · 11

• https://github.com/galette/galette/commit/8f3bdd9f7d0708466e011253064a867ca2b271a5 · Patch
• https://github.com/galette/galette/commit/f54b2570615d38d0302e937079233e52c2d80995 · Patch
• https://github.com/galette/galette/commit/514418da973ae5b84bf97f94bd288a41e8e3f0a6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21319 · Vendor Advisory
• https://bugs.galette.eu/issues/1535 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21319 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21319 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21319 · Security Note
• https://github.com/galette/galette/security/advisories/GHSA-vjc9-mj44-x59q · Note
• https://t.me/cibsecurity/31166 · Telegram Post