CVE-2012-4381

Katalog CVE

CVSS 8.1 · High EPSS 4,1%

Kerentanan Use of Hard-coded Credentials pada mediawiki. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.

Rincian

Terbit di NVD

8 Februari 2020

Terakhir diubah

16 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html patch · release notes · advisory vendor
• https://phabricator.wikimedia.org/T41184 patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2012/08/31/10 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2012/08/31/6 mailing list · patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=853442 issue tracking · patch · advisory pihak ketiga
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 mailing list · advisory pihak ketiga
• http://osvdb.org/show/osvdb/85106 broken link