CVE-2015-0842

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-0842
yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.include.gr/debian/yubiserver/#changelog Release Notes
https://bugs.debian.org/796495 Issue Tracking Vendor Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:debian:yubiserver:0.2-2:*:*:*:*:*:*:*
cpe:2.3:a:debian:yubiserver:0.5-2:*:*:*:*:*:*:*
History

06 Aug 2025, 15:38

Type Values Removed Values Added
CPE cpe:2.3:a:debian:yubiserver:0.5-2:*:*:*:*:*:*:*
cpe:2.3:a:debian:yubiserver:0.2-2:*:*:*:*:*:*:*
References () http://www.include.gr/debian/yubiserver/#changelog - () http://www.include.gr/debian/yubiserver/#changelog - Release Notes
References () https://bugs.debian.org/796495 - () https://bugs.debian.org/796495 - Issue Tracking, Vendor Advisory, Mailing List
First Time Debian yubiserver
Debian

30 Jun 2025, 18:38

Type Values Removed Values Added
Summary
  • (es) yubiserver anterior a 0.6 es propenso a problemas de inyección de SQL, lo que puede llevar a una omisión de autenticación.

27 Jun 2025, 19:15

Type Values Removed Values Added
CWE CWE-89
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

26 Jun 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-26 22:15

Updated : 2025-08-06 15:38

NVD link : CVE-2015-0842

Mitre link : CVE-2015-0842

CVE.ORG link : CVE-2015-0842

JSON object : View

Products Affected

debian

  • yubiserver
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')