Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Remediation

References

CVE-2020-15074

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-17916)

TYPO3 Improper Input Validation Vulnerability (CVE-2013-7079)

Magento Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-7852)

WordPress Plugin Easy Social Feed-Social Photos Gallery-Post Feed-Like Box Cross-Site Scripting (4.4.1)

WordPress Plugin WordPress Mobile app Builder-Convert WordPress site to native mobile apps Arbitrary File Upload (1.05)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-613 CVE-2020-15074