privacyIDEA Improper Input Validation vulnerability

ALTO 7.5CVE-2018-1000809 · GHSA-7qqv-r2q4-jxhm · PYSEC-2018-20 · Published 08/10/2018 · updated 17/06/2026

In breve

CVE-2018-1000809 è una vulnerabilità ALTO (CVSS 7.5) che riguarda privacyidea, privacyidea (privacyidea).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.2% delle vulnerabilità.
Correzione: aggiornare a 2.23.2 o successiva.

Package	Affected versions	Patched versions
privacyidea PyPI	`< 2.23.2`	`2.23.2`
privacyidea privacyidea	`≤ 2.23.1`	No fix yet

Description

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000809 · ADVISORY
privacyidea/privacyidea · WEB
privacyidea/privacyidea commit a3edc09 · WEB
GitHub Advisory GHSA-7qqv-r2q4-jxhm · ADVISORY
privacyidea/privacyidea · PACKAGE
pypa/advisory-database · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free