CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4234
https://notcve.org/view.php?id=CVE-2021-4234
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack. OpenVPN Access Server versiones 2.10 y versiones anteriores, son susceptibles de reenviar múltiples paquetes en respuesta a un paquete de reinicio enviado desde el cliente al que éste no responde de nuevo, resultando en un ataque de amplificación limitada • https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-11-0 • CWE-406: Insufficient Control of Network Message Volume (Network Amplification) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33738
https://notcve.org/view.php?id=CVE-2022-33738
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal OpenVPN Access Server versiones anteriores a 2.11, usa un generador aleatorio débil para crear un token de sesión de usuario para el portal web • https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-11-0 • CWE-331: Insufficient Entropy CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33737
https://notcve.org/view.php?id=CVE-2022-33737
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password El instalador de OpenVPN Access Server crea un archivo de registro legible para todo el mundo, que a partir de la versión 2.10.0 y versiones anteriores a 2.11.0, puede contener una contraseña de administrador generada aleatoriamente • https://openvpn.net/vpn-server-resources/release-notes • CWE-532: Insertion of Sensitive Information into Log File CWE-708: Incorrect Ownership Assignment •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-0547
https://notcve.org/view.php?id=CVE-2022-0547
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. OpenVPN versiones 2.1 hasta v2.4.12 y versión v2.5.6, puede permitir una omisión de autenticación en los complementos de autenticación externa cuando más de uno de ellos hace uso de las respuestas de autenticación diferida, lo que permite que sea concedido acceso a un usuario externo con credenciales sólo parcialmente correctas • https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF https://openvpn.net/community-downloads • CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-31604 – OpenVPN Monitor 1.1.3 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2021-31604
furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. furlongm openvpn-monitor versiones hasta 1.1.3, permite una vulnerabilidad de tipo CSRF para desconectar un cliente arbitrario OpenVPN Monitor versions 1.1.3 and below suffer from a cross site request forgery vulnerability that allows an attacker to disconnect arbitrary VPN clients. • http://packetstormsecurity.com/files/164281/OpenVPN-Monitor-1.1.3-Cross-Site-Request-Forgery.html https://github.com/furlongm/openvpn-monitor/releases • CWE-352: Cross-Site Request Forgery (CSRF) •