SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter of the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:FacetedSearch feature. This flaw allows unauthenticated attackers to inject arbitrary HTML and execute scripts in the browsers of users who visit crafted URLs containing malicious cstate parameters. The vulnerability arises from improper neutralization of input during web page generation, specifically due to unescaped cstate parameters that break out of hidden input attributes. A fix for this issue is available in version 7.2.1.
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via Code-typed property values. The vulnerability arises because the CodeStringValueFormatter renders annotated JSON values with embedded HTML markup unescaped on the Special:Browse page, enabling execution of JavaScript in the browsers of users viewing the page. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit right to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the browsers of users viewing those pages, including administrators. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of arbitrary JavaScript in the context of other users' sessions, including administrators, potentially enabling token theft and unauthorized actions.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This vulnerability allows unauthenticated attackers to inject malicious markup via the unescaped 'id' parameter. An attacker can trick an smw-admin administrator into clicking a crafted link, bypassing the auto-satisfied edit-token check, which leads to script execution and potentially privileged actions within the administrator's session. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This flaw allows editors to inject malicious JavaScript via specially crafted data-* attributes in .smw-highlighter spans, which execute when users hover over them. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject malicious HTML through schema descriptions. The injected HTML is passed unescaped to Html::rawElement() in HtmlBuilder, which can alter pages and affect users who view the compromised schema. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup into semantic property values that are rendered unescaped in autocomplete suggestions. When a user opens the property-value autocomplete with an empty query, the vulnerable jquery.autocomplete.js script inserts raw API values directly into HTML, potentially executing arbitrary scripts. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site request forgery (CSRF) vulnerability in the Special:SMWAdmin page. This flaw allows an attacker to trick an authenticated smw-admin user into performing unintended actions such as schema setup, entity disposal, or job execution, potentially leading to semantic data loss and resource exhaustion. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions 7.3.0 before 7.3.1 have a missing authorization vulnerability in the smwtask update task. This flaw allows users with edit rights to force semantic updates on arbitrary pages, including restricted ones, by supplying a crafted serialized subject parameter. The forced reparsing can lead to semantic-store writes and resource-intensive dependency processing.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a vulnerability that allows low-privilege editors to cause uncontrolled resource consumption. By supplying a large limit parameter to the #set_recurring_event parser function without specifying an end date, attackers can generate a massive number of date subobjects. This leads to exhaustion of CPU, memory, and database resources. The issue is fixed in version 7.3.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have an authorization vulnerability that allows ordinary editors to permanently protect pages by adding an 'Is edit protected' annotation. This occurs when the $smwgEditProtectionRight setting is enabled, causing the EditProtectionUpdater to apply indefinite edit and move restrictions without verifying the author's permissions, effectively locking out other editors and administrators.
SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw arises because certain separator parameters are output without proper HTML escaping in various result printers. An unauthenticated attacker can craft malicious links that execute JavaScript in the context of the wiki, potentially stealing session cookies or CSRF tokens. The vulnerability is fixed in version 7.3.1.
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.