← All advisories

Medium severity6.5NVD Advisory· Published Oct 4, 2018· Updated Jun 17, 2026

CVE-2018-0505

CVE-2018-0505

Description

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mediawiki/corePackagist	>= 1.27.0, < 1.27.5	1.27.5
mediawiki/corePackagist	>= 1.29.0, < 1.29.3	1.29.3
mediawiki/corePackagist	>= 1.30.0, < 1.30.1	1.30.1
mediawiki/corePackagist	>= 1.31.0, < 1.31.1	1.31.1

Affected products

7

MediaWiki/Mediawikiv55 versions
before 1.31.1, 1.30.1, 1.29.3 and 1.27.5+ 4 more
- (no CPE)range: before 1.31.1, 1.30.1, 1.29.3 and 1.27.5
- cpe:2.3:a:mediawiki:mediawiki:1.30.1:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: >=1.31.0,<1.31.1
- cpe:2.3:a:mediawiki:mediawiki:1.27.5:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.29.3:*:*:*:*:*:*:*
ghsa-coords
pkg:composer/mediawiki/core
Range: >= 1.27.0, < 1.27.5
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

10

lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.htmlnvdPatchVendor AdvisoryWEB
phabricator.wikimedia.org/T194605nvdExploitPatchThird Party AdvisoryWEB
www.securitytracker.com/id/1041695nvdThird Party AdvisoryVDB EntryWEB
github.com/advisories/GHSA-5c6w-f4w2-2grpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-0505ghsaADVISORY
www.debian.org/security/2018/dsa-4301nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2019:3142nvdWEB
access.redhat.com/errata/RHSA-2019:3238nvdWEB
access.redhat.com/errata/RHSA-2019:3813nvdWEB
github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2018-0505.yamlghsaWEB

News mentions

0

No linked articles in our index yet.