CVE-2017-5868

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 4.6%

probabilidad de explotación

4.6%top 9% de las CVE

explotación observada

noninguna fuente lo reporta

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Productos afectados

n/a · n/a

Referencias

https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/http://www.openwall.com/lists/oss-security/2017/05/23/13 http://www.securitytracker.com/id/1038547