Openvpn Access Server vulnerabilities
21 vulnerabilities
Known vulnerabilities in Openvpn Access Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2013-2692openvpnopenvpn_access_server
EPSS score0.97%
Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users.CVE-2013-2061debianopenvpn+3EPSS score2.81%
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.CVE-2021-4234openvpnopenvpn_access_serverEPSS score0.89%
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack.CVE-2021-3824openvpnopenvpn_access_serverEPSS score0.75%
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.CVE-2025-3110openvpnaccess server+1EPSS score0.45%
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxyCVE-2020-11462openvpnopenvpn_access_serverEPSS score1.28%
An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.CVE-2020-36382openvpnopenvpn_access_serverEPSS score1.89%
OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.CVE-2020-15074openvpnopenvpn_access_serverEPSS score1.04%
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.CVE-2020-15077openvpnopenvpn_access_serverEPSS score1.21%
OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.CVE-2020-8953openvpnopenvpn_access_serverEPSS score1.34%
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).CVE-2014-9104openvpnopenvpn_access_serverEPSS score0.88%
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.CVE-2014-8104canonicalubuntu_linux+9EPSS score3.48%
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.CVE-2005-3393debianopenvpn+2EPSS score3.48%
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.CVE-2005-3409debianopenvpn+2EPSS score2.50%
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.CVE-2022-33737openvpnopenvpn_access_serverEPSS score0.87%
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin passwordCVE-2022-33738openvpnopenvpn_access_serverEPSS score0.92%
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalCVE-2017-5868openvpnopenvpn_access_serverEPSS score4.62%
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.CVE-2023-46849alpineopenvpn+8EPSS score1.15%
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.CVE-2023-46850alpineopenvpn+8EPSS score2.00%
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.CVE-2006-2229debianopenvpn+2EPSS score1.35%
OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.