MEDIUM6.1
GHSA-59xw-qv23-j3rc
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Quick fix
GHSA-59xw-qv23-j3rc — mediawiki/semantic-media-wiki: upgrade to the fixed version with the command below.
composer require mediawiki/semantic-media-wiki:^7.2.0Details
#### Failure mode
The `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.
#### Remediation
- The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML.
#### Maintenance note
Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/mediawiki/semantic-media-wiki
Introduced in:
0Fixed in: 7.2.0Fix
composer require mediawiki/semantic-media-wiki:^7.2.0