CVE-2020-10184

HIGH

YubiKey One-Time Password Validation Server < 2.40 - Denial of Service via SQL Injection in Verify Endpoint

Title source: llm

Description

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.

References (3)

Core 3

Core References

Exploit, Vendor Advisory x_refsource_misc

https://www.yubico.com/support/security-advisories/ysa-2020-01/

Release Notes, Third Party Advisory x_refsource_misc

https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html

Scores

CVSS v3 7.5

EPSS 0.0150

EPSS Percentile 71.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-89

Status published

Products (1)

yubico/yubikey_one_time_password_validation_server < 2.40

Published Mar 05, 2020

Tracked Since Feb 18, 2026