medium6.1
CVE-2021-30154
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
Impact
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.31.12 from 1.32.0 before 1.35.2 |
| Debian | Debian Linux | Version 10.0 |
| Fedoraproject | Fedora | Versions 33, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T278014
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T278014
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889