CVE-2022-48614: Cross-site Scripting in Semantic MediaWiki
Summary
CVE-2022-48614: Cross-site Scripting in Semantic MediaWiki. Affects mediawiki/semantic-media-wiki versions < 4.0.2. Fixed in 4.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Semantic MediaWiki is a package available on Packagist that provides a framework for managing structured data within a MediaWiki installation. It allows users to define and query data using semantic annotations. This vulnerability affects versions prior to 4.0.2 of Semantic MediaWiki. Semantic MediaWiki includes a special page called Special:Ask, which allows users to perform queries on the stored data. However, due to a lack of input sanitization, it is possible for an attacker to inject malicious scripts into the query parameters, leading to a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability (CVE-2022-48614) in Semantic MediaWiki allows for Reflected XSS attacks. An attacker can craft a specially crafted query parameter that includes malicious JavaScript code. When a user visits a page with the manipulated query parameter, the JavaScript code is executed in the context of the victim's browser, potentially allowing the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the displayed content. This vulnerability has a moderate severity rating according to the Common Vulnerability Scoring System (CVSS) and is classified under CWE-79 (Cross-Site Scripting).
How To Fix
Minimum fixed version
4.0.2
This is the first release that contains the fix.
composer require mediawiki/semantic-media-wiki:4.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by disabling or restricting access to the Special:Ask page in Semantic MediaWiki. This can be done by modifying the configuration or access control settings of the MediaWiki installation. By limiting access to the vulnerable page, the risk of exploitation can be mitigated until a proper fix can be applied.
Conclusion
In conclusion, Semantic MediaWiki versions prior to 4.0.2 are vulnerable to a cross-site scripting (XSS) attack through the Special:Ask page. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Semantic MediaWiki. If immediate upgrade is not possible, restricting access to the vulnerable page can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/semantic-media-wiki →
FAQ
Semantic MediaWiki is a package that extends the functionality of MediaWiki, allowing users to define and query structured data within a MediaWiki installation.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to the execution of malicious scripts in the context of a user's browser. This can result in the theft of sensitive information, unauthorized actions on behalf of the user, or manipulation of displayed content.
To fix this vulnerability, it is recommended to upgrade Semantic MediaWiki to version 4.0.2 or later. This version includes proper input sanitization to prevent the execution of malicious scripts.
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by disabling or restricting access to the Special:Ask page in Semantic MediaWiki.
Yes, this vulnerability has a moderate severity rating according to the Common Vulnerability Scoring System (CVSS).
References
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/semantic-media-wiki.
