GHSA-cw86-j46r-2x7x: Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch
Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCHPROFILESCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must have the smw-schemaedit right. They can create or modify FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels containing markup that escapes option elements.
Who is exposed to the injected script?
Every visitor to Special:FacetedSearch can be exposed to the stored script, including administrators. The issue is therefore particularly significant where untrusted or lower-trust users hold the smw-schemaedit right.
Which versions are affected and what version fixes it?
Semantic MediaWiki versions from 4.2.0 before 7.4.1 are affected. Version 7.4.1 fixes the issue.
What can be done before upgrading?
Restrict the smw-schemaedit right to fully trusted users and review existing FACETEDSEARCH_PROFILE_SCHEMA profile keys and labels for injected markup. Remove any malicious or unexpected values to prevent scripts from running for Special:FacetedSearch visitors.