CVE-2012-1581

MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random
numbers for password reset tokens, which makes it easier for remote
attackers to change the passwords of arbitrary users.
Any extension developers using mt_rand() to generate random numbers in
contexts where security is required are encouraged to instead make use of the
MWCryptRand class introduced with this release.

Bugs

• <https://bugzilla.wikimedia.org/show_bug.cgi?id=35078&gt;