BotPasswords can bypass CentralAuth's account lock

published 2018-10-04 8 y ago modified 2026-06-17 4 mo ago also GHSA-5c6w-f4w2-2grp , EUVD-2022-2560

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

Patch / fix

fixed in 2 distros 3 links 2

packagist mediawiki/core 1.27.5, 1.29.3, 1.30.1, 1.31.1
mediawiki mediawiki 1.31.1

debian red hat arch linux

mediawiki Debian 14, Debian 13, Debian 12 1:1.31.1-1

debian advisories DEBIAN-CVE-2018-0505

mediawiki123 openshift 3.9 1.23.17-1.el7
mediawiki openshift 3.11, openshift 3.10 1.27.7-1.el7

red hat advisories RHSA-2019:3813 RHSA-2019:3238 RHSA-2019:3142

mediawiki Arch Linux 1.31.1-1

arch linux advisories AVG-765

lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html advisory
phabricator.wikimedia.org/T194605 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-0505 updated 2025-11-21 cvss 5.3

mediawiki: BotPassword can bypass CentralAuth's account lock

Red Hat OpenShift Container Platform 3.6 mediawiki123 Red Hat OpenShift Container Platform 3.7 mediawiki123
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 mediawiki
affected: no fix available “Fix deferred”
Red Hat OpenShift Container Platform 3.9 mediawiki123 1.23.17-1.el7
fixed: vendor fix RHSA-2019:3813
Red Hat OpenShift Container Platform 3.10 mediawiki 1.27.7-1.el7
fixed: vendor fix RHSA-2019:3238
Red Hat OpenShift Container Platform 3.11 mediawiki 1.27.7-1.el7
fixed: vendor fix RHSA-2019:3142

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

phabricator.wikimedia.org https://phabricator.wikimedia.org/T194605 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	mediawiki/core	>=1.27.0, <1.27.5 >=1.29.0, <1.29.3 >=1.30.0, <1.30.1 >=1.31.0, <1.31.1	1.27.5 1.29.3 1.30.1 1.31.1

Affected products

mediawiki mediawiki

Classification

Weakness

CWE-287 Improper Authentication

References

lists.wikimedia.org /pipermail/wikitech-l/2018-September/090849.html
mailing-list, web, patch, vendor-advisory
phabricator.wikimedia.org /T194605
web, exploit, patch, third-party-advisory
debian.org /security/2018/dsa-4301
vendor-advisory, web, third-party-advisory
access.redhat.com /errata/RHSA-2019:3142
vendor-advisory, web
access.redhat.com /errata/RHSA-2019:3238
vendor-advisory, web
access.redhat.com /errata/RHSA-2019:3813
vendor-advisory, web
securitytracker.com /id/1041695
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-0505
advisory
github.com /FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2018-0505.yaml
web
github.com /wikimedia/mediawiki
package

Sources

CVE List CVE-2018-0505
GitHub Advisory GHSA-5c6w-f4w2-2grp
NVD CVE-2018-0505

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary