CVE-2020-10185 Business logic in n/a
Remote attackers can replay One-Time Passwords in self-hosted YubiKey Validation Servers with open sync pools, bypassing authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10185?
CVE-2020-10185 is a high-severity vulnerability in n/a, published on 5 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.
Weakness: CWE-294
Which versions are affected by CVE-2020-10185?
It affects 1 product.
Products include Yubico Yubikey One Time Password Validation Server.
How do I fix CVE-2020-10185?
Upgrade to a fixed version.
Is CVE-2020-10185 being exploited?
There is no known exploitation of CVE-2020-10185 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xcc3-mxq7-rg5h, UBUNTU-CVE-2020-10185.