CVE-2022-24584 — MEDIUM (6.5)

Vulnerability Description

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Yubico	Otp	-

Related Weaknesses (CWE)

CWE-863

References

https://demo.yubico.com/otp/verifyVendor Advisory
https://pastebin.com/7iLR1EbWExploitThird Party Advisory
https://pastebin.com/xAh8uV6JThird Party Advisory
https://upload.yubico.com/Vendor Advisory
https://demo.yubico.com/otp/verifyVendor Advisory
https://pastebin.com/7iLR1EbWExploitThird Party Advisory
https://pastebin.com/xAh8uV6JThird Party Advisory
https://upload.yubico.com/Vendor Advisory

FAQ

What is CVE-2022-24584?

CVE-2022-24584 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credenti...

How severe is CVE-2022-24584?

CVE-2022-24584 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-24584?

Check the references section above for vendor advisories and patch information. Affected products include: Yubico Otp.