← Back to CVEs

CVE-2024-24761

HIGH

7.5

Description

Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/6/2024

Last Modified12/17/2024

Sourcenvd

Honeypot Sightings0

Affected Products

galette:galette

Weaknesses (CWE)

CWE-863CWE-863

References

https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb(security-advisories@github.com)

https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv(security-advisories@github.com)

https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.