CVE-2021-30154: XSS
Published Apr 6, 2021
·Updated
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header- messages are output in HTML unescaped, leading to XSS.
Affected Software
6 affected componentsFixes available
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1
MediaWiki MediaWiki<1.31.12
MediaWiki MediaWiki>=1.32.0<1.35.2
Debian Debian Linux=10.0
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Remediation
Patch Available
Event History
Apr 6, 2021
CVE Published
via MITRE·06:43 AM
Data Sourced
via MITRE·06:43 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-30154?
CVE-2021-30154 is classified as a medium severity vulnerability due to the potential for XSS attacks.
2
How do I fix CVE-2021-30154?
To mitigate CVE-2021-30154, upgrade MediaWiki to versions 1.31.16, 1.35.2, or higher.
3
Which versions of MediaWiki are affected by CVE-2021-30154?
MediaWiki versions before 1.31.12 and between 1.32.0 and 1.35.2 are affected by CVE-2021-30154.
4
What type of vulnerability is CVE-2021-30154?
CVE-2021-30154 is a cross-site scripting (XSS) vulnerability that occurs due to unescaped HTML output.
5
Is CVE-2021-30154 relevant for Debian users?
Yes, CVE-2021-30154 affects Debian users running vulnerable versions of MediaWiki.