CVE-2012-4381

Name: CVE-2012-4381
Creator: NVD / NIST
Published: 2020-02-08T18:15:11.243+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 4.06%

Last modified Jun 16, 2026

CVE-2012-4381 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.. EPSS estimates a 4.06% chance of exploitation in the next 30 days.

Description

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

4.06%

89.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-798

Affected Software

Vendor	Product	Versions
Mediawiki	Mediawiki	< 1.18.5
Mediawiki	Mediawiki	>= 1.19.0, < 1.19.2

References

http://osvdb.org/show/osvdb/85106Broken Link
http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853442Issue Tracking, Patch, Third Party Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T41184Patch, Vendor Advisory
http://osvdb.org/show/osvdb/85106Broken Link
http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853442Issue Tracking, Patch, Third Party Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T41184Patch, Vendor Advisory

Timeline

Published: Feb 8, 2020
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2012-4381?

How severe is CVE-2012-4381?

CVE-2012-4381 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 4.06% probability of exploitation in the next 30 days.

How do I fix CVE-2012-4381?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-4381?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST