CVE-2012-4381: Mediawiki

High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days.

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.

Affected products

• Mediawiki Mediawiki: before 1.18.5 (fixed in 1.18.5); from 1.19.0, before 1.19.2 (fixed in 1.19.2)

Published 2020-02-08. Last modified 2026-06-16.