Description

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.

Remediation

References

CVE-2012-1581

Related Vulnerabilities

ReviveAdserver Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-7368)

Oracle Database Server CVE-2014-6546 Vulnerability (CVE-2014-6546)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-32669)

Roundcube Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-44026)

Moodle Improper Input Validation Vulnerability (CVE-2012-6101)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-1581