CVE-2020-10185

ALTO 8.6CVE-2020-10185 · Published 05/03/2020 · updated 17/06/2026

In breve

CVE-2020-10185 è una vulnerabilità ALTO (CVSS 8.6) che riguarda yubikey one time password validation server (yubico).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.0% delle vulnerabilità.
Correzione: aggiornare a 2.40 o successiva.

Package	Affected versions	Patched versions
yubikey one time password validation server yubico	`< 2.40`	`2.40`

Description

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.

References

Yubico/yubikey-val release yubikey-val-2.40 · Release Notes
lists.debian.org/debian-lts-announce/2020/03/msg00014.html
yubico.com/support/security-advisories/ysa-2020-01 · Exploit

Altre vulnerabilità di yubikey one time password validation server

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free