High severity vulnerability that affects privacyIDEA

2019-01-1416:19:31

Google

osv.dev

0.001 Low

EPSS

Percentile

34.6%

JSON

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.

CPENameOperatorVersion
privacyideaeq2.8dev4
privacyideaeq2.7
privacyideaeq2.18.dev7
privacyideaeq2.16.1
privacyideaeq2.17
privacyideaeq2.9dev2
privacyideaeq2.22.dev3
privacyideaeq2.6dev4
privacyideaeq1.2.1
privacyideaeq1.0dev5

Name	Operator	Version
privacyidea	eq	2.8dev4
privacyidea	eq	2.7
privacyidea	eq	2.18.dev7
privacyidea	eq	2.16.1
privacyidea	eq	2.17
privacyidea	eq	2.9dev2
privacyidea	eq	2.22.dev3
privacyidea	eq	2.6dev4
privacyidea	eq	1.2.1
privacyidea	eq	1.0dev5