{"id":"CVE-2018-1000809","aliases":["EUVD-2018-0117","GHSA-7qqv-r2q4-jxhm","PYSEC-2018-20"],"status":"published","title":"privacyIDEA Improper Input Validation vulnerability","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01689,"percentile":0.77212,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-10-08T15:00:00Z","modified":"2026-10-20T10:52:50Z","fixes":[{"ecosystem":"PyPI","package":"privacyidea","fixed_in":["2.23.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"privacyidea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"privacyidea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.2"}]}],"versions":["1.0","1.0dev4","1.0dev5","1.0dev6","1.0dev7","1.1","1.2","1.2.1","1.2.1-dev0","1.2.2","1.2.3","1.3","1.3.1","1.3.2","1.3.3","1.4","1.4.1","1.4dev5","1.5","1.5.1","1.5.1.1","2.0","2.0.1","2.0dev1","2.1","2.10","2.10.1","2.10.2","2.10dev2","2.10dev4","2.10dev5","2.10dev6","2.11","2.11.1","2.11.2","2.11.3","2.11dev2","2.12","2.12.1","2.13","2.14","2.15","2.16","2.16.1","2.17","2.17.dev4","2.17.dev5","2.17.dev6","2.18","2.18.1","2.18.dev3","2.18.dev4","2.18.dev5","2.18.dev6","2.18.dev7","2.19","2.19.1","2.19.dev2","2.2","2.2.1","2.20","2.20.1","2.20.dev1","2.20.dev2","2.20.dev3","2.20.dev4","2.21","2.21.1","2.21.2","2.21.3","2.21.4","2.21.dev2","2.22","2.22.1","2.22.1.dev1","2.22.2","2.22.2.dev1","2.22.4","2.22.dev3","2.22.dev4","2.22.dev7","2.23","2.23.1","2.23.dev3","2.23.dev4","2.23.dev5","2.23.dev6","2.23.dev7","2.23.dev8","2.23.dev9","2.3","2.3.1","2.3.2","2.4","2.5","2.6","2.6dev0","2.6dev1","2.6dev2","2.6dev4","2.6dev5","2.7","2.7.1","2.7dev3","2.8","2.8.1","2.8dev4","2.8dev5","2.8dev7","2.9","2.9dev2"]},{"source":"osv","ecosystem":"PyPI","package":"privacyidea","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"a3edc09beffa2104f357fe24971ea3211ce40751"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.2"}]}],"versions":["1.0","1.0dev4","1.0dev5","1.0dev6","1.0dev7","1.1","1.2","1.2.1","1.2.1-dev0","1.2.2","1.2.3","1.3","1.3.1","1.3.2","1.3.3","1.4","1.4.1","1.4dev5","1.5","1.5.1","1.5.1.1","2.0","2.0.1","2.0dev1","2.1","2.10","2.10.1","2.10.2","2.10dev2","2.10dev4","2.10dev5","2.10dev6","2.11","2.11.1","2.11.2","2.11.3","2.11dev2","2.12","2.12.1","2.13","2.14","2.15","2.16","2.16.1","2.17","2.17.dev4","2.17.dev5","2.17.dev6","2.18","2.18.1","2.18.dev3","2.18.dev4","2.18.dev5","2.18.dev6","2.18.dev7","2.19","2.19.1","2.19.dev2","2.2","2.2.1","2.20","2.20.1","2.20.dev1","2.20.dev2","2.20.dev3","2.20.dev4","2.21","2.21.1","2.21.2","2.21.3","2.21.4","2.21.dev2","2.22","2.22.1","2.22.1.dev1","2.22.2","2.22.2.dev1","2.22.4","2.22.dev3","2.22.dev4","2.22.dev7","2.23","2.23.1","2.23.dev3","2.23.dev4","2.23.dev5","2.23.dev6","2.23.dev7","2.23.dev8","2.23.dev9","2.3","2.3.1","2.3.2","2.4","2.5","2.6","2.6dev0","2.6dev1","2.6dev2","2.6dev4","2.6dev5","2.7","2.7.1","2.7dev3","2.8","2.8.1","2.8dev4","2.8dev5","2.8dev7","2.9","2.9dev2"]}],"products":[{"vendor":"privacyidea","product":"privacyidea"}],"references":[{"url":"https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/privacyidea/privacyidea/issues/1227","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000809","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7qqv-r2q4-jxhm","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/privacyidea/PYSEC-2018-20.yaml","tags":["web"]},{"url":"https://github.com/privacyidea/privacyidea","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-1000809","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2018-10-08T15:00:00Z","modified":"2024-09-16T23:15:58.103Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-0117","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2018-10-08T15:00:00Z","modified":"2024-09-16T23:15:58Z","updated_at":"2026-11-03T00:54:55.200068Z"}],"ghsa":[{"id":"GHSA-7qqv-r2q4-jxhm","title":"privacyIDEA Improper Input Validation vulnerability","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2019-01-14T16:19:31Z","modified":"2024-10-18T21:59:16Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2018-1000809","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2018-10-08T15:29:01.057Z","modified":"2026-06-17T01:33:05.49Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:42.52179Z"}],"osv":[{"id":"CVE-2018-1000809","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2018-10-08T15:29:01.057Z","modified":"2026-10-20T10:52:50.929796062Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"GHSA-7qqv-r2q4-jxhm","title":"privacyIDEA Improper Input Validation vulnerability","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2019-01-14T16:19:31Z","modified":"2024-10-18T22:22:58.534148Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"PYSEC-2018-20","description":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=\u003cspace\u003e\u0026pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.","status":"published","published":"2018-10-08T15:29:00Z","modified":"2023-11-08T03:59:40.255809Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}