CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2017/05/23/13 | Exploit Mailing List Third Party Advisory |
| http://www.securitytracker.com/id/1038547 | Third Party Advisory VDB Entry |
| https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/ | Exploit Mitigation Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2017/05/23/13 | Exploit Mailing List Third Party Advisory |
| http://www.securitytracker.com/id/1038547 | Third Party Advisory VDB Entry |
| https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/ | Exploit Mitigation Third Party Advisory |
Configurations
History
21 Nov 2024, 03:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2017/05/23/13 - Exploit, Mailing List, Third Party Advisory | |
| References | () http://www.securitytracker.com/id/1038547 - Third Party Advisory, VDB Entry | |
| References | () https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/ - Exploit, Mitigation, Third Party Advisory |
Information
Published : 2017-05-26 01:29
Updated : 2024-11-21 03:28
NVD link : CVE-2017-5868
Mitre link : CVE-2017-5868
CVE.ORG link : CVE-2017-5868
JSON object : View
Products Affected
openvpn
- openvpn_access_server
CWE
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')