Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3813 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the mediawiki123 RPM package for Red Hat OpenShift Container Platform 3.9.102.

    Security Fix(es):

    * mediawiki: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'     (CVE-2018-0503)

    * mediawiki: Information exposure when a log event is (partially) hidden (CVE-2018-0504)

    * mediawiki: BotPassword can bypass CentralAuth's account lock (CVE-2018-0505)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3238 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * mediawiki: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'     (CVE-2018-0503)

    * mediawiki: Information exposure when a log event is (partially) hidden (CVE-2018-0504)

    * mediawiki: BotPassword can bypass CentralAuth's account lock (CVE-2018-0505)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3142 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains an updated mediawiki RPM package for Red Hat OpenShift Container Platform 3.11.

    Security Fix(es):

    * mediawiki: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'     (CVE-2018-0503)

    * mediawiki: BotPassword can bypass CentralAuth's account lock (CVE-2018-0505)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

https://www.mediawiki.org/wiki/Release_notes/1.29#MediaWiki_1.29.3

  - (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry     for 'user' overrides 'newbie'.

  - (T194605, CVE-2018-0505) SECURITY: BotPasswords can     bypass CentralAuth's account lock.

  - (T180551) Fix LanguageSrTest for language converter

  - (T180552) Fix langauge converter parser test with     self-close tags

  - (T180537) Remove $wgAuth usage from wrapOldPasswords.php

  - (T180485) InputBox: Have inputbox langconvert certain     attributes

  - (T161732, T181547) Upgraded Moment.js from v2.15.0 to     v2.19.3.

  - (T172927) Drop vendor from MW release branch

  - (T87572) Make FormatMetadata::flattenArrayReal() work     for an associative array

  - Updated composer/spdx-licenses from 1.1.4 to 1.3.0     (development dependency).

  - (T189567) the CLI installer (maintenance/install.php)     learned to detect and include extensions. Pass
    --with-extensions to enable that feature.

  - (T182381) Mask deprecated call in WatchedItemUnitTest

  - (T190503) Let built-in web server (maintenance/dev)     handle .php requests.

  - The karma qunit tests would fail on some configuration     due to headers already sent. Check headers_sent() before     sending cpPosTime headers

  - (T167507) selenium: Run Chrome headlessly.

  - selenium: Pass -no-sandbox to Chrome under Docker

  - (T191247) Use MediaWiki\SuppressWarnings around     trigger_error() instead @

  - (T75174, T161041) Unit test     ChangesListSpecialPageTest::testFilterUserExpLevel fails     under SQLite.

  - (T192584) Stop incorrectly passing USE INDEX to     RecentChange::newFromConds().

  - (T179190) selenium: Move test running logic from     package.json to selenium.sh.

  - (T117839, T193200) PDFHandler: Fix for pdfinfo changes     in poppler-utils 0.48.

  - Add default edit rate limit of 90 edits/minute for all     users.

  - (T196125) php-memcached 3.0 (provided with PHP 7.0) is     now supported.

  - (T196672) The mtime of extension.json files is now able     to be zero

  - (T180403) Validate $length in padleft/padright parser     functions.

  - (T143790) Make $wgEmailConfirmToEdit only affect edit     actions.

  - (T194237) Special:BotPasswords now requires     reauthentication.

  - (T191608, T187638) Add 'logid' parameter to Special:Log.

  - (T176097) resourceloader: Disable a flaky     MessageBlobStoreTest case

  - (T193829) Indicate when a Bot Password needs reset.

  - (T151415) Log email changes.

  - (T118420) Unbreak Oracle installer.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MediaWiki reports :

Security fixes :

T169545: $wgRateLimits entry for 'user' overrides 'newbie'.

T194605: BotPasswords can bypass CentralAuth's account lock.

T187638: When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden

T193237: Special:BotPasswords should require reauthenticate.

Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work, which result in incorrectly configured rate limits, information disclosure in Special:Redirect/logid and bypass of an account lock.

ID	Name	Product	Family	Severity
130749	RHEL 7 : OpenShift Container Platform 3.9 mediawiki123 (RHSA-2019:3813)	Nessus	Red Hat Local Security Checks	medium
130383	RHEL 7 : OpenShift Container Platform 3.10 mediawiki (RHSA-2019:3238)	Nessus	Red Hat Local Security Checks	medium
130044	RHEL 7 : OpenShift Container Platform 3.11 mediawiki (RHSA-2019:3142)	Nessus	Red Hat Local Security Checks	medium
120910	Fedora 29 : mediawiki (2018-f4b65fc7cd)	Nessus	Fedora Local Security Checks	medium
120855	Fedora 28 : mediawiki (2018-e022ecbc52)	Nessus	Fedora Local Security Checks	medium
117965	Fedora 27 : mediawiki (2018-edf90410ea)	Nessus	Fedora Local Security Checks	medium
117652	FreeBSD : mediawiki -- multiple vulnerabilities (be1aada2-be6c-11e8-8fc6-000c29434208)	Nessus	FreeBSD Local Security Checks	medium
117645	Debian DSA-4301-1 : mediawiki - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-0505

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium