Threats tagged 'ghsa-4cv4-rp7r-qh6c'

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing these jobs, which may degrade system performance and alter semantic data.