| Vulnerability Name: | CVE-2012-4381 (CCN-176315) | ||||||||||||||||||||||||
| Assigned: | 2012-08-31 | ||||||||||||||||||||||||
| Published: | 2012-08-31 | ||||||||||||||||||||||||
| Updated: | 2020-02-12 | ||||||||||||||||||||||||
| Summary: | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-798 | ||||||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2012-4381 Source: MISC Type: Broken Link http://osvdb.org/show/osvdb/85106 Source: MISC Type: Mailing List, Patch, Third Party Advisory http://www.openwall.com/lists/oss-security/2012/08/31/10 Source: MISC Type: Mailing List, Patch, Third Party Advisory http://www.openwall.com/lists/oss-security/2012/08/31/6 Source: MISC Type: Mailing List, Third Party Advisory https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 Source: CCN Type: Red Hat Bugzilla Bug 853442 (CVE-2012-4381) - CVE-2012-4381 mediawiki: Password saved always to the local MediaWiki database and possibility to use old passwords for non-existing accounts in the external auth system Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=853442 Source: XF Type: UNKNOWN mediawiki-cve20124381-info-disc(176315) Source: MISC Type: Patch, Release Notes, Vendor Advisory https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html Source: MISC Type: Patch, Vendor Advisory https://phabricator.wikimedia.org/T41184 Source: CCN Type: MediaWiki Web site MediaWiki | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||