Semanticmediawiki
Monthly
Stored cross-site scripting in Semantic MediaWiki 3.1.0 through 6.x lets users with the MediaWiki 'edit' right inject arbitrary HTML and JavaScript via the data-subtab attribute, with execution occurring when a victim views the affected page. Publicly available exploit code exists, but the independent assessment rates this as a moderate-severity issue because it requires edit privileges and user interaction. The flaw is fixed in Semantic MediaWiki 7.0.0.
Reflected cross-site scripting in Semantic MediaWiki 7.0.0 through 7.1.0 lets an unauthenticated attacker execute arbitrary script in a victim's browser on the wiki origin by tricking them into opening a crafted Special:Ask link carrying a forged cursor pagination token. The cursor parameter added in 7.0.0 is an unsigned base64url-encoded JSON blob, so its sort_prop and sort_order fields are fully attacker-controlled; when they mismatch the request's sort=/order= values, the resulting error string is interpolated into Query::addErrors() and rendered as raw HTML by Html::errorBox(), bypassing the message-layer sanitization that normally protects SMW error output. Exploitation requires victim interaction (clicking the link) and is aided by the absence of a Content-Security-Policy on responses, which permits inline script to run; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the maintainer advisory documents a browser-confirmed reproduction, and the CVSS 3.1 score is 6.1 with a scope change. Upgrading to 7.2.0 removes the vulnerability.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier lets an unauthenticated remote attacker inject arbitrary markup into the query debug output rendered on Special:Ask, executing JavaScript in the browser of a victim who follows a crafted link. No account, privilege, or attacker-created wiki content is required: the predefined text-type properties such as Text (_txt) that ship on every default install satisfy the property-type condition the payload needs, so a URL like Special:Ask?q=[[Text::<script>...</script>]]&debug=1 is sufficient. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 base score, reflecting a scope-changing, low-impact script injection that depends on user interaction and is therefore not self-propagating or wormable; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing). Vendor-released patch: 7.2.0.
An open redirect in the Semantic MediaWiki extension (versions up to and including 7.1.0) lets an unauthenticated remote attacker craft a Special:URIResolver subpage link that issues an HTTP 303 redirect to an off-host destination, optionally embedding user:pass@host credentials in the URL authority. Because the redirect originates from a trusted wiki domain, the link is usable for phishing or credential-harvesting lures, though exploitation requires the victim to follow the crafted URL (UI:R) and no server data disclosure or code execution results directly. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; the vendor addressed the flaw in Semantic MediaWiki 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows unauthenticated attackers to inject arbitrary HTML markup into the Special:Ask table output by abusing the `sep` (separator) parameter, which was inserted verbatim into the HTML that joins a table cell's values. Because the same unsanitized table HTML is produced for the raw request output (request_type=raw), no authentication is needed to reach the injection, though exploitation is limited by user interaction: a victim must be induced to load a crafted query URL for the payload to execute in their browser. The issue is correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) as a moderate-severity reflected XSS; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 7.2.0.
Stored cross-site scripting in Semantic MediaWiki 3.1.0 through 6.x lets users with the MediaWiki 'edit' right inject arbitrary HTML and JavaScript via the data-subtab attribute, with execution occurring when a victim views the affected page. Publicly available exploit code exists, but the independent assessment rates this as a moderate-severity issue because it requires edit privileges and user interaction. The flaw is fixed in Semantic MediaWiki 7.0.0.
Reflected cross-site scripting in Semantic MediaWiki 7.0.0 through 7.1.0 lets an unauthenticated attacker execute arbitrary script in a victim's browser on the wiki origin by tricking them into opening a crafted Special:Ask link carrying a forged cursor pagination token. The cursor parameter added in 7.0.0 is an unsigned base64url-encoded JSON blob, so its sort_prop and sort_order fields are fully attacker-controlled; when they mismatch the request's sort=/order= values, the resulting error string is interpolated into Query::addErrors() and rendered as raw HTML by Html::errorBox(), bypassing the message-layer sanitization that normally protects SMW error output. Exploitation requires victim interaction (clicking the link) and is aided by the absence of a Content-Security-Policy on responses, which permits inline script to run; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the maintainer advisory documents a browser-confirmed reproduction, and the CVSS 3.1 score is 6.1 with a scope change. Upgrading to 7.2.0 removes the vulnerability.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier lets an unauthenticated remote attacker inject arbitrary markup into the query debug output rendered on Special:Ask, executing JavaScript in the browser of a victim who follows a crafted link. No account, privilege, or attacker-created wiki content is required: the predefined text-type properties such as Text (_txt) that ship on every default install satisfy the property-type condition the payload needs, so a URL like Special:Ask?q=[[Text::<script>...</script>]]&debug=1 is sufficient. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 base score, reflecting a scope-changing, low-impact script injection that depends on user interaction and is therefore not self-propagating or wormable; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing). Vendor-released patch: 7.2.0.
An open redirect in the Semantic MediaWiki extension (versions up to and including 7.1.0) lets an unauthenticated remote attacker craft a Special:URIResolver subpage link that issues an HTTP 303 redirect to an off-host destination, optionally embedding user:pass@host credentials in the URL authority. Because the redirect originates from a trusted wiki domain, the link is usable for phishing or credential-harvesting lures, though exploitation requires the victim to follow the crafted URL (UI:R) and no server data disclosure or code execution results directly. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; the vendor addressed the flaw in Semantic MediaWiki 7.2.0.
Reflected cross-site scripting in Semantic MediaWiki 7.1.0 and earlier allows unauthenticated attackers to inject arbitrary HTML markup into the Special:Ask table output by abusing the `sep` (separator) parameter, which was inserted verbatim into the HTML that joins a table cell's values. Because the same unsanitized table HTML is produced for the raw request output (request_type=raw), no authentication is needed to reach the injection, though exploitation is limited by user interaction: a victim must be induced to load a crafted query URL for the payload to execute in their browser. The issue is correctly rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) as a moderate-severity reflected XSS; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in version 7.2.0.