CVE-2021-30157: XSS

Q: What is the severity of CVE-2021-30157?

CVE-2021-30157 has been identified as a moderate severity vulnerability associated with XSS due to unescaped HTML output.

Q: How do I fix CVE-2021-30157?

To fix CVE-2021-30157, upgrade your MediaWiki installation to a version equal to or greater than 1.31.12 or 1.35.2.

Q: Which versions of MediaWiki are affected by CVE-2021-30157?

MediaWiki versions before 1.31.12 and from 1.32.0 to 1.35.1 are affected by CVE-2021-30157.

Q: What type of vulnerability is CVE-2021-30157?

CVE-2021-30157 is classified as a cross-site scripting (XSS) vulnerability.

Q: Is there a specific operating system impacted by CVE-2021-30157?

Yes, CVE-2021-30157 affects MediaWiki installations on Debian and Fedora operating systems.

Published Apr 6, 2021

Updated

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter- label messages are output in HTML unescaped, leading to XSS.

Affected Software

6 affected componentsFixes available

debian/mediawiki

1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1

MediaWiki MediaWiki<1.31.12

MediaWiki MediaWiki>=1.32.0<1.35.2

Debian Debian Linux=10.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Remediation

Patch Available

https://phabricator.wikimedia.org/T278058

Event History

Apr 6, 2021

CVE Published

via MITRE·06:43 AM

Data Sourced

via MITRE·06:43 AM

Description

Frequently Asked Questions

What is the severity of CVE-2021-30157?

CVE-2021-30157 has been identified as a moderate severity vulnerability associated with XSS due to unescaped HTML output.

How do I fix CVE-2021-30157?