EUVD-2025-209538
GHSA-p2jw-3hf7-269m
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionNVD
Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
AnalysisAI
Reflected cross-site scripting (XSS) in Semantic MediaWiki 5.0.2 allows unauthenticated remote attackers to inject malicious JavaScript via the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. A victim visiting an attacker-crafted URL executes arbitrary JavaScript in their browser, enabling session cookie theft or unauthorized actions on behalf of the user. User interaction (clicking the link) is required. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Semantic MediaWiki is a PHP-based extension for MediaWiki that adds semantic annotations and querying capabilities. The vulnerability exists in the special page 'GefacetteerdZoeken' (Faceted Search in Dutch), which processes user-supplied input via URL parameters without proper output encoding. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where untrusted user input is echoed into HTML response without sanitization or HTML entity encoding. This allows attackers to bypass the intended logic and inject script tags or event handlers that execute in the context of the victim's browsing session, with full access to site cookies and DOM APIs.
RemediationAI
Apply the vendor-released patch immediately for Semantic MediaWiki 5.0.2, available from INCIBE at https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki. If a patched version number is not yet provided by the vendor, contact Semantic MediaWiki maintainers or apply updates to the 'GefacetteerdZoeken' special page component. As a temporary compensating control, restrict access to the Speciaal:GefacetteerdZoeken endpoint via Web Application Firewall (WAF) rules blocking requests with suspicious URL parameters (e.g., HTML entities, script tags) until patching is complete; this may degrade faceted search functionality for end users. Additionally, implement Content Security Policy (CSP) headers with script-src 'self' to mitigate the impact of reflected XSS, though this does not prevent the attack and users can still be compromised via DOM-based attacks.
Share
External POC / Exploit Code
Leaving vuln.today