CVE-2024-8474
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
OpenVPN Connect anterior a la versión 3.5.0 puede contener la clave privada en texto plano del perfil de configuración que se registra en el registro de la aplicación, que un actor no autorizado puede usar para descifrar el tráfico VPN.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-09-05 CVE Reserved
- 2025-01-06 CVE Published
- 2025-01-06 CVE Updated
- 2025-01-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://openvpn.net/connect-docs/android-release-notes.html | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| OpenVPN Search vendor "OpenVPN" | OpenVPN Connect Search vendor "OpenVPN" for product "OpenVPN Connect" | <= 3.5.0 Search vendor "OpenVPN" for product "OpenVPN Connect" and version " <= 3.5.0" | en |
Affected
| ||||||