Unrated
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will...
CVE-2021-30458
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-30458 mediawiki Fixed in: 1:1.35.2-1
- Ubuntu UBUNTU-CVE-2021-30458 mediawiki
Original description The description as published by the source.
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory security.gentoo.org
- advisory mediawiki.org
- report phabricator.wikimedia.org