Description
Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SemanticMediaWiki | SemanticMediaWiki | 2.5.0 – < 7.4.1 | 7.4.1 |
References
- GitHub Security Advisory (GHSA-mc5x-2j7v-x8hp) vendor-advisory
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c9bf9f25549bb2f5eab916339b267a1732002c4c patch
- SemanticMediaWiki 7.4.1 Release Notes release-notes
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/Browse/ValueFormatter.php#L34-L55 technical-description
- VulnCheck Advisory: Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title third-party-advisory