CVEvulnerability

CVE-2020-15074

7.5 HIGH Published 2020-07-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-07-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-302, CWE-613

Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Affected configurations

• openvpn openvpn access server (< 2.8.4) • openvpn openvpn access server (>= 2.9.0 < 2.9.6)

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-302 Authentication Bypass by Assumed-Immutable Data weakness

References