Remote Code Injection in OpenVPN Access Server Web Login Interface
CVE-2021-3824

6.1MEDIUM

Key Information:

Vendor

Openvpn
Status
Openvpn Access Server
Vendor
CVE Published:
23 September 2021

What is CVE-2021-3824?

The OpenVPN Access Server versions 2.9.0 through 2.9.4 are susceptible to a vulnerability that allows remote attackers to inject arbitrary web scripts or HTML code via the web login page URL. This flaw could potentially enable attackers to execute malicious scripts in the context of a user’s session, compromising the integrity and confidentiality of sensitive information. Users of affected versions are advised to update to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

OpenVPN Access Server 2.9.0 through 2.9.4

References

https://openvpn.net/vpn-server-resources/release-notes/#o...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.