CVEvulnerability
CVE-2014-9104
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.
Affected configurations
• openvpn openvpn access server (<= 1.5.6)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://openvpn.net/index.php/access-server/security-advisories.html Vendor Advisory
- http://seclists.org/fulldisclosure/2014/Jul/76 Exploit
- http://www.securityfocus.com/archive/1/532795/100/0/threaded www.securityfocus.com
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt Exploit
- https://www.youtube.com/watch?v=qhgysgfvQh8 Exploit
- http://openvpn.net/index.php/access-server/security-advisories.html Vendor Advisory
- http://seclists.org/fulldisclosure/2014/Jul/76 Exploit
- http://www.securityfocus.com/archive/1/532795/100/0/threaded www.securityfocus.com
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt Exploit
- https://www.youtube.com/watch?v=qhgysgfvQh8 Exploit