medium6.1
CVE-2021-30157
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
Impact
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.31.12 from 1.32.0 before 1.35.2 |
| Debian | Debian Linux | Version 10.0 |
| Fedoraproject | Fedora | Versions 33, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T278058
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T278058
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889