GHSA-9w3p-9m8x-j2mw: Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.
Event History
Frequently Asked Questions
Who can exploit this issue and what access do they need?
Any editor who lacks the edit-protection right can exploit it. They need only be able to edit a page or, for broader impact, edit a template that is widely transcluded.
What is the practical impact of a successful exploit?
An attacker can mark pages as edit protected, causing the TitleQuickPermissions hook to block other editors and administrators from editing, moving, or deleting those pages indefinitely. A widely used template can extend this disruption to many pages.
Which versions are affected?
Semantic MediaWiki versions from 2.5.0 before 7.4.1 are affected. Version 7.4.1 is identified in the available release reference.
How can administrators check for signs of exploitation?
Review affected pages and templates for the annotation [[Is edit protected::true]] or use of #set to assign Is edit protected. Pay particular attention to widely transcluded templates and pages that administrators cannot edit, move, or delete.