---

CVE-2021-30154 - log back

CVE-2021-30154 edited at 06 Apr 2021 09:00:55
Severity	- Unknown + Medium
Remote	- Unknown + Remote
Type	- Unknown + Cross-site scripting
Description	+ An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to cross-site scripting (XSS).
References	+ https://phabricator.wikimedia.org/T278014 + https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/fbe24e55cd013781f039d8fc2e8804edf107fd34%5E%21/
Notes

CVE-2021-30154 created at 06 Apr 2021 08:57:38