{"action":"Upgrade mediawiki/core to 1.27.5 or later.","affected":[{"fixed":"1.27.5","introduced":"1.27.0"},{"fixed":"1.29.3","introduced":"1.29.0"},{"fixed":"1.30.1","introduced":"1.30.0"},{"fixed":"1.31.1","introduced":"1.31.0"}],"component":"mediawiki/core","cve_ids":["CVE-2018-0505"],"ecosystem":"Packagist","epss":0.0197,"exploited":false,"fixed_versions":["1.27.5","1.29.3","1.30.1","1.31.1"],"ghsa_id":"GHSA-5c6w-f4w2-2grp","id":"tcs_01M5KEVY5VX60K7G3ADPYQMSD6","modified_at":"2024-05-19T02:24:41.798854Z","published_at":"2022-05-13T01:31:04Z","references":["https://osv.dev/vulnerability/GHSA-5c6w-f4w2-2grp","https://nvd.nist.gov/vuln/detail/CVE-2018-0505","https://access.redhat.com/errata/RHSA-2019:3142","https://access.redhat.com/errata/RHSA-2019:3238","https://access.redhat.com/errata/RHSA-2019:3813","https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2018-0505.yaml","https://github.com/wikimedia/mediawiki","https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html","https://phabricator.wikimedia.org/T194605","https://www.debian.org/security/2018/dsa-4301","http://www.securitytracker.com/id/1041695"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-5c6w-f4w2-2grp","url":"https://osv.dev/vulnerability/GHSA-5c6w-f4w2-2grp"}],"summary":"Mediawiki BotPassword can bypass CentralAuth's account lock"}