Description

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Remediation

References

CVE-2017-5868

Related Vulnerabilities

SharePoint CVE-2022-24472 Vulnerability (CVE-2022-24472)

Oracle HTTP Server Improper Access Control Vulnerability (CVE-2026-34291)

Jboss EAP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7465)

WordPress Plugin WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Unspecified Vulnerability (5.1)

WordPress Plugin CallRail Phone Call Tracking Cross-Site Request Forgery (0.4.9)

Severity

Medium

Classification

CVE-2017-5868 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities