GHSA-7qqv-r2q4-jxhmHighCVSS 7.5

privacyIDEA Improper Input Validation vulnerability

Published
January 14, 2019
Last Modified
October 18, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000809 →

📋 Description

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.

🎯 Affected products1

  • pip/privacyIDEA:< 2.23.2

🔗 References (5)