CVE-2017-5868: openvpn openvpn_access_server CRLF Injection

Vulnerability summary

CVE-2017-5868 is a medium (CVSS 6.1) CRLF Injection vulnerability in openvpn openvpn_access_server. EPSS estimates a 4.62% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 25-05-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.