CVE-2015-8626
CriticalSummary
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, making it easier for remote attackers to gain access via a brute-force attack.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to update MediaWiki to the latest version to eliminate this vulnerability and ensure that passwords meet the minimum length requirements.
Original NVD description (English source)
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.