Description

The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.

Remediation

References

CVE-2015-8626

Related Vulnerabilities

WordPress Plugin Content Blocks (Custom Post Widget) Local File Inclusion (3.3.0)

WordPress Plugin CM Ad Changer Multiple Cross-Site Scripting Vulnerabilities (1.7.2)

MySQL CVE-2016-3614 Vulnerability (CVE-2016-3614)

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2020-8450)

WordPress Plugin RegistrationMagic-Custom Registration Forms, User Registration, Payment, and User Login Cross-Site Scripting (5.0.1.8)

Severity

Critical

Classification

CVE-2015-8626 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities