SemanticMediaWiki vulnerabilities and threats

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site scripting (XSS) vulnerability. This flaw arises because malicious semantic property values are rendered unescaped in autocomplete suggestions, allowing attackers to inject markup. Specifically, the jquery.autocomplete.js script inserts raw API values into HTML via container.html(), which can alter the dropdown content and potentially execute arbitrary scripts when a user opens the property-value autocomplete with an empty query. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site request forgery (CSRF) vulnerability in the Special:SMWAdmin page. This flaw allows attackers to trick authenticated smw-admin users into executing unwanted actions such as schema setup, entity disposal, or job operations, potentially leading to semantic data loss and resource exhaustion. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 contain a missing authorization vulnerability in the smwtask update task. This flaw allows users with edit rights to force semantic updates on arbitrary pages, including restricted ones, by supplying a serialized subject parameter. The vulnerability can trigger forced reparsing, semantic-store writes, and resource-intensive dependency processing.

Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have a vulnerability that allows anonymous attackers to cause uncontrolled resource consumption. By supplying a zero limit parameter to the Special:PropertyLabelSimilarity feature, attackers can trigger quadratic computation through repeated pairwise similar_text() comparisons. This can exhaust PHP CPU, memory, and database connections, leading to denial of service.

Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have a vulnerability that allows low-privilege editors to cause uncontrolled resource consumption. By using the #set_recurring_event parser function without specifying an end date and supplying a large limit parameter, attackers can generate millions of date subobjects. This leads to exhaustion of CPU, memory, and database resources. The issue is fixed in version 7.3.1.

Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have an authorization vulnerability that allows ordinary editors to permanently protect pages by adding a specific annotation. This flaw occurs when the $smwgEditProtectionRight setting is enabled, causing indefinite edit and move restrictions to be applied without verifying the author's permissions, effectively locking out other editors and administrators.

SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw occurs because certain separator parameters are output without proper HTML escaping in various result printers. Unauthenticated attackers can exploit this by crafting malicious Special:Ask links that execute JavaScript in the victim's browser within the wiki's origin, potentially stealing session information or CSRF tokens. The vulnerability is fixed in version 7.3.1.

SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the unescaped default parameter in JsonResultPrinter. Exploitation involves tricking users into clicking a specially crafted Special:Ask link with a zero-result query and request_type=special_page, leading to JavaScript execution in the context of the wiki origin. The vulnerability was fixed in version 7.3.1.

Semantic MediaWiki versions 7.3.0 before 7.3.1 have a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates using the public anonymous CSRF token. Exploitation can lead to arbitrary job execution in unlimited quantities, unauthorized updates on sysop-protected pages, page title leakage, and resource exhaustion.

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an algorithmic complexity vulnerability in the TermParser::normalize_compact_form() function. This flaw allows unauthenticated attackers to submit specially crafted long search terms with many distinct in:(...) or has:(...) expressions to the Special:Search page, causing quadratic CPU consumption and exhausting PHP search workers when the extended search engine is enabled. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions 3.0.0 up to but not including 7.3.1 contain an uncontrolled recursion vulnerability in the LegacyParser::getSubqueryDescription() function. This flaw allows unauthenticated attackers to submit deeply nested queries via the action=ask API, causing excessive CPU and memory consumption that can tie up server request workers. The vulnerability is fixed in version 7.3.1.