{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-03T22:35:52.988","vulnerabilities":[{"cve":{"id":"CVE-2018-1000809","sourceIdentifier":"cve@mitre.org","published":"2018-10-08T15:29:01.057","lastModified":"2026-06-17T01:33:05.490","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2."},{"lang":"es","value":"privacyIDEA en versiones 2.23.1 y anteriores contiene una validación incorrecta de validación de entradas incorrecta en la API de validación de tokens que puede resultar en una denegación de servicio (DoS). Este ataque parece ser explotable mediante una petición HTTP con user=pass= en la URL /validate/check. La vulnerabilidad parece haber sido solucionada en la versión 2.23.2."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:privacyidea:privacyidea:*:*:*:*:*:*:*:*","versionEndIncluding":"2.23.1","matchCriteriaId":"A2F0738D-4CC2-40E8-AE07-0D70461519D4"}]}]}],"references":[{"url":"https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/privacyidea/privacyidea/issues/1227","source":"cve@mitre.org","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/privacyidea/privacyidea/issues/1227","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]}]}}]}