An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
References
Link | Resource |
---|---|
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ | |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ | |
https://phabricator.wikimedia.org/T278014 | Exploit Issue Tracking Patch Vendor Advisory |
https://security.gentoo.org/glsa/202107-40 | Third Party Advisory |
https://www.debian.org/security/2021/dsa-4889 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
10 Dec 2021, 18:34
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
References | (MISC) https://phabricator.wikimedia.org/T278014 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/ - Mailing List, Third Party Advisory |
Information
Published : 2021-04-06 07:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-30154
Mitre link : CVE-2021-30154
CVE.ORG link : CVE-2021-30154
JSON object : View
Products Affected
debian
- debian_linux
fedoraproject
- fedora
mediawiki
- mediawiki
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')