CVE-2022-24584

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere

• CWE-863

• https://demo.yubico.com/otp/verifyVendor Advisory
• https://pastebin.com/7iLR1EbWExploit, Third Party Advisory
• https://pastebin.com/xAh8uV6JThird Party Advisory
• https://upload.yubico.com/Vendor Advisory
• https://demo.yubico.com/otp/verifyVendor Advisory
• https://pastebin.com/7iLR1EbWExploit, Third Party Advisory
• https://pastebin.com/xAh8uV6JThird Party Advisory
• https://upload.yubico.com/Vendor Advisory

Published

May 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24577GPAC 1.0.1 is affected by a NULL pointer dereference in gf_u…7.8
• CVE-2022-24578GPAC 1.0.1 is affected by a heap-based buffer overflow in SF…7.8
• CVE-2022-2458XML external entity injection(XXE) is a vulnerability that a…8.2
• CVE-2022-24580Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24581ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash…7.5
• CVE-2022-24582Accounting Journal Management 1.0 is vulnerable to XSS-PHPSE…5.4
• CVE-2022-24585A stored cross-site scripting (XSS) vulnerability in the com…5.4
• CVE-2022-24586A stored cross-site scripting (XSS) vulnerability in the com…5.4
• CVE-2022-24587A stored cross-site scripting (XSS) vulnerability in the com…5.4
• CVE-2022-24588Flatpress v1.2.1 was discovered to contain a cross-site scri…5.4
• CVE-2022-24589Burden v3.0 was discovered to contain a stored cross-site sc…6.1
• CVE-2022-2459An issue has been discovered in GitLab EE affecting all vers…2.7