GHSA-3r5m-693w-jm33: Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with permission to edit profiles or schemas can inject HTML into FacetedSearch exploration-link labels. Exploitation also requires a user to view the affected Special:FacetedSearch page.
What is the impact on users who view a malicious label?
The injected markup can alter the Special:FacetedSearch page and may execute scripts in the viewer's browser. The provided vector indicates impacts to confidentiality and integrity, including across a subsequent system scope.
Which versions are affected?
Semantic MediaWiki versions from 4.2.0 before 7.3.1 are affected. Version 7.3.1 is identified as the first version outside the affected range.