CVEvulnerability

CVE-2023-7245

7.8 HIGH Published 2024-02-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-02-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-95

Description

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable

Affected configurations

• openvpn connect (>= 3.2.0 < 3.4.4) • openvpn connect (>= 3.2.0 < 3.4.8) • openvpn connect 3.0.0 • openvpn connect 3.0.1 • openvpn connect 3.0.2 • openvpn connect 3.1.0 • openvpn connect 3.1.1 • openvpn connect 3.1.2 • openvpn connect 3.1.3

Related

Weakness · CWE (1)

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References