CVE-2012-1581

Severity

50%

Complexity

99%

Confidentiality

48%

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N).

Overview

Type

MediaWiki

First reported 12 years ago

2012-09-09 21:55:00

Last updated 7 years ago

2017-08-29 01:31:00

Affected Software

MediaWiki 1.17

1.17

MediaWiki 1.17.0 beta 1

1.17

MediaWiki 1.17.0

1.17.0

MediaWiki 1.17.0 release candidate 1

1.17.0

MediaWiki 1.17.1

1.17.1

MediaWiki 1.17.2

1.17.2

MediaWiki 1.18

1.18

MediaWiki 1.18 beta 1

1.18

MediaWiki 1.18.0

1.18.0

MediaWiki 1.18.0 release candidate 1

1.18.0

MediaWiki 1.18.1

1.18.1

References

[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3

Vendor Advisory

[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2

Vendor Advisory

48504

Vendor Advisory

[oss-security] 20120322 MediaWiki security and maintenance release 1.18.2

[oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2

52689

https://bugzilla.wikimedia.org/show_bug.cgi?id=35078

mediawiki-random-numbers-sec-bypass(78910)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.