Lucene search

OpenVPNCVE-2020-15078

HistoryApr 26, 2021 - 2:15 p.m.

CVE-2020-15078

2021-04-2614:15:08

CWE-306

CWE-305

OpenVPN

web.nvd.nist.gov

179

openvpn

cve-2020-15078

authentication bypass

access control

information leak

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.029

Percentile

90.8%

JSON

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

Affected configurations

Nvd

Node

openvpnopenvpnRange<2.4.11

openvpnopenvpnRange2.5.0–2.5.2

Node

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

fedoraprojectfedoraMatch34

Node

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch20.04lts

canonicalubuntu_linuxMatch20.10

canonicalubuntu_linuxMatch21.04

Node

debiandebian_linuxMatch9.0

CNA Affected

[
  {
    "product": "OpenVPN",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.1 and earlier versions"
      }
    ]
  }
]