Authentication Bypass in OpenVPN Access Server by OpenVPN
CVE-2020-15077

5.3MEDIUM

Key Information:

Vendor

Openvpn
Status
Openvpn Access Server
Vendor
CVE Published:
4 June 2021

What is CVE-2020-15077?

OpenVPN Access Server versions 2.8.7 and prior are susceptible to an authentication bypass vulnerability. This vulnerability allows remote attackers to circumvent authentication mechanisms on servers configured with deferred authentication. As a result, attackers can gain unauthorized access to sensitive control channel data, potentially leading to further information leaks. It is essential for users to update their OpenVPN Access Server to the latest version to mitigate this risk.

Affected Version(s)

OpenVPN Access Server 2.8.7 and earlier versions

References

https://openvpn.net/vpn-server-resources/release-notes/
x_refsource_MISC
https://openvpn.net/security-advisory/access-server-secur...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.