CVE-2021-30154 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Cross-site scripting
Description	An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to cross-site scripting (XSS).

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-1775	mediawiki	1.35.1-2	1.35.2-1	Medium	Fixed

References
https://phabricator.wikimedia.org/T278014 https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/fbe24e55cd013781f039d8fc2e8804edf107fd34%5E%21/