CVE-2018-0505

CVE-2018-0505 · BotPasswords can bypass CentralAuth's account lock

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

CVSS 6.5 · Medium · EPSS 2.0% · Fix available

Stack: system · php

Affected products and versions

mediawiki
Versions
- before 1.31.1, 1.30.1, 1.29.3 and 1.27.5: Affected
No fix published
mediawiki Debian:12
Affected ranges
- ECOSYSTEM: < 1:1.31.1-1
Update to 1:1.31.1-1
mediawiki Debian:13
Affected ranges
- ECOSYSTEM: < 1:1.31.1-1
Update to 1:1.31.1-1
mediawiki Debian:14
Affected ranges
- ECOSYSTEM: < 1:1.31.1-1
Update to 1:1.31.1-1
mediawiki/core Packagist
Versions
- 1.27.0
- 1.27.1
- 1.27.2
- 1.27.3
- 1.27.4
Affected ranges
- ECOSYSTEM: ≥ 1.27.0, < 1.27.5
Update to 1.27.5
mediawiki/core Packagist
Versions
- 1.29.0
- 1.29.1
- 1.29.2
Affected ranges
- ECOSYSTEM: ≥ 1.29.0, < 1.29.3
Update to 1.29.3
mediawiki/core Packagist
Versions
- 1.30.0
Affected ranges
- ECOSYSTEM: ≥ 1.30.0, < 1.30.1
Update to 1.30.1
mediawiki/core Packagist
Versions
- 1.31.0
Affected ranges
- ECOSYSTEM: ≥ 1.31.0, < 1.31.1
Update to 1.31.1
mediawiki Ubuntu:18.04:LTS
Versions
- 1:1.27.3-1
- 1:1.27.4-1
- 1:1.27.4-2
- 1:1.27.4-3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published