CVE-2020-10184: SQL Injection
Published Mar 5, 2020
·Updated
The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.
Affected Software
1 affected component
Yubico Yubikey One Time Password Validation Server<2.40
Event History
Mar 5, 2020
CVE Published
via MITRE·10:48 PM
Data Sourced
via MITRE·10:48 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-10184.
2
What is the severity rating of CVE-2020-10184?
The severity rating of CVE-2020-10184 is high with a score of 7.5.
3
What is the affected software for CVE-2020-10184?
The affected software for CVE-2020-10184 is Yubico Yubikey One Time Password Validation Server up to version 2.39.
4
What is the impact of CVE-2020-10184?
CVE-2020-10184 allows remote attackers to cause a denial of service through SQL injection.
5
Are there any known fixes for CVE-2020-10184?
Yes, the fix for CVE-2020-10184 was released in YubiKey Validation Server version 2.40.