CVE-2020-10184 - CVE House
Back to Database
Status published High CVE-2020-10184

The verify endpoint in YubiKey Validation Server before 2.40 does...

Vulnerability Description

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10184

Credits & Attribution

No credits recorded in the NVD database.

References

More from yubico

View All →
CVE-2022-24584
Incorrect access control in Yubico OTP functionality of the YubiKey...
Medium 6.5
CVE-2021-43399
The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell...
High 7.5
CVE-2021-32489
An issue was discovered in the _send_secure_msg() function of Yubico...
Medium 4.4
CVE-2021-31924
Yubico pam-u2f before 1.1.1 has a logic issue that, depending...
Medium 6.8
CVE-2021-28484
An issue was discovered in the /api/connector endpoint handler in...
High 7.5

Affected Vendor

Affected Software

yubikey one time password validation server
Vulnerable Versions:
0

Timeline

Official Publish: March 5th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.