| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | = 1.28.0= 1.28.1= 1.28.2= 1.29.0= 1.29.1≤ 1.27.3 |
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free