CVE-2020-10184

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of…

published March 5, 2020

CVSS
—
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01504 · 74.1th percentile
Published
2020-03-05T22:48Z
EPSS history
Timeline
  • 05 MAR 22:48Z
    The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of…
    cvelistv5