Log File Exposure in OpenVPN Access Server Installer
CVE-2022-33737

7.5HIGH

Key Information:

Vendor

Openvpn
Status
Openvpn Access Server
Vendor
CVE Published:
6 July 2022

What is CVE-2022-33737?

The OpenVPN Access Server installer creates a log file that can be read by any user, which may contain a randomly generated administrative password. This vulnerability is present in versions 2.10.0 and earlier, potentially exposing sensitive information and allowing unauthorized access to administrative functionalities.

Affected Version(s)

OpenVPN Access Server from version 2.10.0 and before 2.11.0

References

https://openvpn.net/vpn-server-resources/release-notes/
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.