Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the Special:Ask feature when used with the ElasticStore backend. This flaw allows users with edit permissions to inject malicious scripts through unescaped native_result and score_set outputs. An attacker can embed harmful markup in a Text property or subobject name and then trick other users, including administrators, into visiting a specially crafted Special:Ask link, leading to script execution within their session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions 7.3.1 through 7.4.0 contain an incorrect authorization vulnerability in the EditProtectionUpdater::userMayChangeProtection() function. This flaw allows editors to bypass administrator edit and move protections by adding a specific template directive that removes protection logged under the administrator's name. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a denial of service vulnerability due to inefficient algorithmic complexity in certain classes. This flaw allows users with page-edit rights to create acyclic chains of Concept: pages that cause excessive CPU and memory consumption when queried, leading to service disruption. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw exists in the ValueFormatter::getFormattedSubject() function, which improperly renders property label segments after a literal non-breaking space ( ) as unescaped markup. Users with page-edit rights can exploit this by setting a preferred property label containing a malicious img onerror payload. This payload executes when any user, including administrators, views the Special:Browse page or accesses the smwbrowse API.
Semantic MediaWiki versions from 2.4.0 up to but not including 7.4.1 contain a reflected cross-site scripting (XSS) vulnerability in the TimeValueFormatter::getCaptionFromFreeFormat() function. This function outputs free-format date captions in HTML without proper escaping, allowing unauthenticated attackers to craft malicious Special:Ask URLs that include HTML markup. When a logged-in user accesses such a URL, the embedded script executes in their browser session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 have an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter. This flaw allows users with page-edit rights to create mutually referencing concept pages, which can cause concept page views, Special:Ask queries, or api.php action=ask queries to exhaust PHP memory or stack. The issue is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 have a missing authorization vulnerability. This flaw allows editors without the edit-protection right to lock pages by adding an 'Is edit protected' annotation. Attackers can exploit this by adding [[Is edit protected::true]] to pages or widely transcluded templates, causing the TitleQuickPermissions hook to block other editors and administrators from editing, moving, or deleting those pages indefinitely. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the DataTables integration. This flaw allows users with page-edit rights to inject HTML entity-encoded markup into data-search or data-filter cell attributes, which can execute scripts in the browsers of viewers, including administrators. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the OptionsBuilder::profiles() function. This flaw allows users with the smw-schemaedit permission to inject malicious markup by saving specially crafted FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The injected scripts execute for every visitor to the Special:FacetedSearch page, including administrators. The vulnerability is fixed in version 7.4.1.