Lucene search

OpenVPNCVE-2020-36382

HistoryJun 04, 2021 - 11:15 a.m.

CVE-2020-36382

2021-06-0411:15:07

CWE-754

CWE-617

OpenVPN

web.nvd.nist.gov

cve-2020-36382

openvpn

access server

remote attackers

assert

user authentication

denial of service

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.

Affected configurations

Nvd

Node

openvpnopenvpn_access_serverRange2.7.3–2.8.7

VendorProductVersionCPE
openvpnopenvpn_access_server*cpe:2.3:a:openvpn:openvpn_access_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openvpn	openvpn_access_server	*	cpe:2.3:a:openvpn:openvpn_access_server::::::::

CNA Affected

[
  {
    "product": "OpenVPN Access Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "2.7.3 to 2.8.7"
      }
    ]
  }
]

References

openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/

openvpn.net/vpn-server-resources/release-notes/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

Related for CVE-2020-36382