cbcvebase.
CVE-2018-0505
published 2018-10-04

CVE-2018-0505: Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

PriorityP433medium6.5CVSS 3.0
AVNACLPRLUINSUCNIHAN
EPSS
1.93%
77.9th percentile
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

Affected

15 ranges
VendorProductVersion rangeFixed in
debiandebian_linux——
debianmediawiki< mediawiki 1:1.31.1-1 (bookworm)mediawiki 1:1.31.1-1 (bookworm)
mediawikicore>= 1.27.0 < 1.27.51.27.5
mediawikicore>= 1.29.0 < 1.29.31.29.3
mediawikicore>= 1.30.0 < 1.30.11.30.1
mediawikicore>= 1.31.0 < 1.31.11.31.1
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki>= 0 < 1:1.31.1-11:1.31.1-1
mediawikimediawiki>= 0 < 1:1.31.1-11:1.31.1-1
mediawikimediawiki>= 0 < 1:1.31.1-11:1.31.1-1
mediawikimediawiki>= 0 < 1:1.31.1-11:1.31.1-1
mediawikimediawiki>= 1.31.0 < 1.31.11.31.1

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.