CVE-2020-36382: openvpn openvpn_access_server
CVSS: 7.5v3.1HighModified
Published 04-06-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-36382 is a high (CVSS 7.5) vulnerability in openvpn openvpn_access_server. EPSS estimates a 1.89% chance of exploitation in the next 30 days, higher than 79.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.89%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 04-06-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.89%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.89% on 20-09-2026
20-09-202620-10-2026
EPSS score1.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Openvpn1 product
- openvpn_access_server≥ 2.7.3, ≤ 2.8.7
1 vendor · 1 product
References
2 links- openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/X Refsource MISCVendor Advisory