GHSA-mvpf-4wj8-2hwf: Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the resulting script execution?
An attacker must be able to store a malicious semantic property value. The payload is triggered when another user opens property-value autocomplete with an empty query, so users who perform that action are exposed.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required, but the vulnerability description requires an attacker to store a malicious semantic property value. Exploitation also requires user interaction: a victim must open the property-value autocomplete with an empty query.
Which versions are affected?
Semantic MediaWiki versions from 3.0.0 before 7.3.1 are affected. Version 7.3.1 is the first version identified as not affected.
What can be done if upgrading is not immediately possible?
The available information does not provide a vendor workaround. As a temporary risk-reduction measure, restrict who can store or modify semantic property values and avoid opening property-value autocomplete with an empty query.