CVE-2015-8626 The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which mak...
CriticalCVSS 9.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mediawiki(Debian:12) | < 1:1.25.5-1 | 1:1.25.5-1 |
| debian/mediawiki(Debian:13) | < 1:1.25.5-1 | 1:1.25.5-1 |
| debian/mediawiki(Debian:14) | < 1:1.25.5-1 | 1:1.25.5-1 |
| mediawiki | <= 1.23.11 | No fix listed |
| mediawiki | = 1.24.0 | No fix listed |
| mediawiki | = 1.24.1 | No fix listed |
| mediawiki | = 1.24.2 | No fix listed |
| mediawiki | = 1.24.3 | No fix listed |
| mediawiki | = 1.24.4 | No fix listed |
| mediawiki | = 1.25.0 | No fix listed |
| mediawiki | = 1.25.1 | No fix listed |
| mediawiki | = 1.25.2 | No fix listed |
| mediawiki | = 1.25.3 | No fix listed |
| mediawiki | = 1.26.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-8626 vendor-advisory
- [oss-security] 20151221 CVE requests for MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 mailing-list patch third-party-advisory
- [oss-security] 20151223 Re: CVE requests for MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 mailing-list patch third-party-advisory
- [MediaWiki-announce] 20151221 [MediaWiki-announce] Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12 mailing-list patch release-notes vendor-advisory
- phabricator.wikimedia.org patch third-party-advisory