Threats tagged 'ghsa-fmrr-242f-45jx'

Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 contain a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates. Exploitation can involve using the public anonymous CSRF token with the run-joblist function to execute arbitrary job types repeatedly or invoking updates on sysop-protected pages, potentially leaking page titles and exhausting system resources.