SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because attackers can embed HTML markup inside a valid JSON value, which is then rendered unescaped on the Special:Browse page, leading to JavaScript execution in the browsers of users viewing the page.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and execute scripts in users' browsers via crafted URLs targeting the Special:FacetedSearch page. The vulnerability arises from unescaped cstate parameters that break out of hidden input attributes. The CVSS 3.1 base score is 6.1, indicating a medium severity issue.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing these jobs, which may degrade system performance and alter semantic data.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the context of viewers, including administrators.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with profile or schema editing permissions to inject malicious HTML through FacetedSearch exploration-link labels. The injected markup is passed unescaped to the page rendering function, potentially enabling script execution in the browsers of users viewing the affected Special:FacetedSearch page.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via External identifier property values. The injected scripts are rendered unescaped on the Special:Browse page, enabling execution of JavaScript in the context of viewers' sessions, including administrators. The vulnerability has a medium severity rating with a CVSS score of 5.4.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This vulnerability arises because data-* attributes are rendered via innerHTML with allowHTML enabled, allowing editors to inject malicious JavaScript through specially crafted .smw-highlighter spans. When other users, including administrators, hover over these elements, the malicious script executes.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject malicious HTML code via schema descriptions. The injected HTML is rendered unescaped, enabling alteration of pages and potential targeting of users who view the affected schema pages.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of JavaScript in the context of other users' sessions, including administrators, potentially enabling token theft and unauthorized actions.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This vulnerability allows unauthenticated attackers to inject malicious markup via the unescaped 'id' parameter. By tricking an administrator into clicking a crafted link, attackers can bypass the auto-satisfied edit-token check and execute scripts within the administrator's session, potentially performing privileged actions.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup into semantic property values that are rendered unescaped in autocomplete suggestions. When a user opens the property-value autocomplete with an empty query, the vulnerable JavaScript concatenates raw API values into HTML, potentially executing arbitrary scripts.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site request forgery (CSRF) vulnerability in the Special:SMWAdmin page. This vulnerability allows an attacker to trick an authenticated smw-admin user into performing unintended actions such as schema setup, entity disposal, or job execution. Exploitation can result in semantic data loss and resource exhaustion.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a vulnerability that allows anonymous attackers to cause excessive resource consumption. By sending repeated requests to the Special:PropertyLabelSimilarity page with a limit parameter set to zero, attackers can bypass SQL limits and trigger quadratic computations. This leads to exhaustion of PHP CPU, memory, and database connections, resulting in a denial of service condition.
Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 have a missing authorization vulnerability in the smwtask update task. This flaw allows users with edit rights to force semantic updates on arbitrary pages, potentially causing resource-intensive operations and unauthorized semantic-store writes.
SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw arises because certain separator parameters are output without proper HTML escaping in various result printers. Unauthenticated attackers can exploit this by crafting malicious Special:Ask links that execute JavaScript in the context of the wiki, potentially stealing session cookies or CSRF tokens.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an uncontrolled recursion vulnerability in the LegacyParser::getSubqueryDescription() function. This flaw allows unauthenticated attackers to submit deeply nested query elements to the action=ask API, causing excessive CPU and memory consumption that can tie up server request workers. The vulnerability leads to a denial-of-service condition by exhausting server resources.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have an improper authorization vulnerability. This flaw allows ordinary editors to add an 'Is edit protected' annotation, which causes indefinite edit and move restrictions to be applied without verifying the author's rights. As a result, other editors and administrators can be locked out of editing or moving pages permanently.
Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 contain a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates. Exploitation can involve using the public anonymous CSRF token with the run-joblist function to execute arbitrary job types repeatedly or invoking updates on sysop-protected pages, potentially leaking page titles and exhausting system resources.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the unescaped default parameter in JsonResultPrinter. Exploitation involves tricking users into visiting a specially crafted Special:Ask link with a zero-result query and a specific request_type, leading to execution of JavaScript in the context of the wiki. This can result in theft of session cookies or CSRF tokens.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain an uncontrolled resource consumption vulnerability. This flaw allows low-privilege editors to bypass the smwgMaxNumRecurringEvents limit by supplying a large limit parameter. Attackers can exploit this by saving pages with #set_recurring_event without specifying an end date, causing the creation of thousands or millions of date subobjects. This results in exhaustion of CPU, memory, and database resources, leading to denial of service conditions.