Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Summary

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.

Remediation

1. Inventory every SemanticMediaWiki SemanticMediaWiki deployment, including staging.
2. Upgrade SemanticMediaWiki SemanticMediaWiki to 7.3.1.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7f7v-2qf4-gfq3
• Advisoryhttps://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-csrf-via-special-smwadmin-maintenance-actions