Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the Special:Ask feature when used with the ElasticStore backend. This flaw allows users with edit permissions to inject malicious scripts through unescaped native_result and score_set outputs. An attacker can embed harmful markup in a Text property or subobject name and then trick other users, including administrators, into visiting a specially crafted Special:Ask link, leading to script execution within their session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions 7.3.1 through 7.4.0 contain an incorrect authorization vulnerability in the EditProtectionUpdater::userMayChangeProtection() function. This flaw allows editors to bypass administrator edit and move protections by adding a specific template directive that removes protection logged under the administrator's name. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a denial of service vulnerability due to inefficient algorithmic complexity in certain classes. This flaw allows users with page-edit rights to create acyclic chains of Concept: pages that cause excessive CPU and memory consumption when queried, leading to service disruption. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw exists in the ValueFormatter::getFormattedSubject() function, which improperly renders property label segments after a literal non-breaking space ( ) as unescaped markup. Users with page-edit rights can exploit this by setting a preferred property label containing a malicious img onerror payload. This payload executes when any user, including administrators, views the Special:Browse page or accesses the smwbrowse API.
Semantic MediaWiki versions from 2.4.0 up to but not including 7.4.1 contain a reflected cross-site scripting (XSS) vulnerability in the TimeValueFormatter::getCaptionFromFreeFormat() function. This function outputs free-format date captions in HTML without proper escaping, allowing unauthenticated attackers to craft malicious Special:Ask URLs that include HTML markup. When a logged-in user accesses such a URL, the embedded script executes in their browser session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 have an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter. This flaw allows users with page-edit rights to create mutually referencing concept pages, which can cause concept page views, Special:Ask queries, or api.php action=ask queries to exhaust PHP memory or stack. The issue is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 have a missing authorization vulnerability. This flaw allows editors without the edit-protection right to lock pages by adding an 'Is edit protected' annotation. Attackers can exploit this by adding [[Is edit protected::true]] to pages or widely transcluded templates, causing the TitleQuickPermissions hook to block other editors and administrators from editing, moving, or deleting those pages indefinitely. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the DataTables integration. This flaw allows users with page-edit rights to inject HTML entity-encoded markup into data-search or data-filter cell attributes, which can execute scripts in the browsers of viewers, including administrators. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the OptionsBuilder::profiles() function. This flaw allows users with the smw-schemaedit permission to inject malicious markup by saving specially crafted FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The injected scripts execute for every visitor to the Special:FacetedSearch page, including administrators. The vulnerability is fixed in version 7.4.1.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter in the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:FacetedSearch feature. This flaw allows unauthenticated attackers to inject arbitrary HTML and script code via crafted cstate parameters, potentially leading to script execution in users' browsers. The vulnerability is fixed in version 7.2.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing queued jobs, which may degrade performance and alter semantic data. The vulnerability is fixed in version 7.3.0.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because the CodeStringValueFormatter renders annotated JSON values containing HTML markup unescaped on the Special:Browse page, enabling JavaScript execution in the browsers of users viewing the page. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the browsers of users viewing those pages, including administrators.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of arbitrary JavaScript in the context of other users' sessions, including administrators, potentially allowing token theft and unauthorized actions. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via External identifier property values. The vulnerability arises because the ExternalIdentifierValue renders markup payloads unescaped on the Special:Browse page, enabling script execution in the browsers of users viewing the page, including administrators. The issue is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This flaw allows unauthenticated attackers to inject malicious markup via the unescaped id parameter. By tricking an smw-admin administrator into clicking a crafted link, attackers can bypass the auto-satisfied edit-token check and execute scripts within the administrator's session, potentially performing privileged actions.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This flaw arises because data-* attributes are rendered via innerHTML with allowHTML enabled, allowing editors to insert malicious JavaScript in specific span elements. When users, including administrators, hover over these elements, the malicious script executes. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject arbitrary HTML through schema descriptions. The injected HTML is passed unescaped to Html::rawElement() in HtmlBuilder, which can alter pages and potentially target users who view the affected schema. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with profile or schema editing permissions can inject malicious HTML into FacetedSearch exploration-link labels. This injected markup is rendered without proper escaping on the Special:FacetedSearch page, potentially allowing script execution in the browsers of users viewing that page. The vulnerability is fixed in version 7.3.1.