CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10184
https://notcve.org/view.php?id=CVE-2020-10184
The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud. El endpoint verify en YubiKey Validation Server versiones anteriores a 2.40, no comprueba la longitud de consultas SQL, lo que permite a atacantes remotos causar una denegación de servicio, también se conoce como inyección SQL. NOTA: este problema es potencialmente relevante para personas ajenas a Yubico que operan un servicio de comprobación OTP auto alojado; El problema NO afecta a YubiCloud. • https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html https://www.yubico.com/support/security-advisories/ysa-2020-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10185
https://notcve.org/view.php?id=CVE-2020-10185
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud. El endpoint sync en YubiKey Validation Server versiones anteriores a 2.40, permite a atacantes remotos reproducir una OTP. NOTA: este problema es potencialmente relevante para personas ajenas a Yubico que operan un servicio de comprobación OTP auto alojado con una configuración no predeterminada, tales como un grupo de sincronización abierto; El problema NO afecta a YubiCloud. • https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40 https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html https://www.yubico.com/support/security-advisories/ysa-2020-01 • CWE-294: Authentication Bypass by Capture-replay •