CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.

• CWE-798

• http://osvdb.org/show/osvdb/85106Broken Link
• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853442Issue Tracking, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T41184Patch, Vendor Advisory
• http://osvdb.org/show/osvdb/85106Broken Link
• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853442Issue Tracking, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T41184Patch, Vendor Advisory

Published

Feb 8, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4363Multiple unspecified vulnerabilities in Adobe Reader through…
• CVE-2012-4366Belkin wireless routers Surf N150 Model F7D1301v1, N900 Mode…
• CVE-2012-4377Cross-site scripting (XSS) vulnerability in MediaWiki before…
• CVE-2012-4378Multiple cross-site scripting (XSS) vulnerabilities in Media…
• CVE-2012-4379MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not s…
• CVE-2012-4380MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows rem…
• CVE-2012-4382MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not p…
• CVE-2012-4383contao prior to 2.11.4 has a sql injection vulnerability8.8
• CVE-2012-4384letodms has multiple XSS issues: Reflected XSS in Login Page…6.1
• CVE-2012-4385letodms 3.3.6 has CSRF via change password6.5
• CVE-2012-4386The token check mechanism in Apache Struts 2.0.0 through 2.3…
• CVE-2012-4387Apache Struts 2.0.0 through 2.3.4 allows remote attackers to…